Yes you can combine authorization rules. See details here
Private access is built in to Amplify - See docs here referencing private access
Yes, the process of storing would be the same, the only difference is you would need to deal with standard streaming / buffering protocols on the client that are agnostic to Amplify.
We're a place where coders share, stay up-to-date and grow their careers.
We strive for transparency and don't collect excess data.