... visitors of my website can't see the JSON file from it's URL, but that JavaScript file can access it?
JavaScript is the wrong thing to be using if you're dealing with secure files. It sounds like you have javascript code that fetches special JSON code from the server you don't want guests to see, but if guests view source code and figure out the URL to the special code, they can access the URL directly in their browser and see everything.
You're better off using a database system to store data that users can't see. Look into MySQL.
If that doesn't work for you, you can try creating files and saving them at a location on the server inaccessible to users then use a script that reads them and only prints information users can see.