Require authentication

I have a directory under our website that I want to require authenciation.
Our IIS server is on our domain. I tried setting up a local user on the IIS
server and disabled anonymous access and enabled Integrated Windows
Authentication. When I hit the directory from the web I get a username and
password prompt. But when I try to use the local user account I setup on the
web server I get error 401. If I use domain.local\username and the
corresponding password I can access the directory. I believe that this is
sending the password in the clear out over the Internet for access to my
domain. What is the correct way to set this up so that I can require
authentication for this specific directory. I don't mind using domain user
accounts for authentication but how would I setup SSL for that directory and
not the rest of the site?

TIA
TRD