I see you tried to add a password. What do you mean by "I didn't have much luck?" Know that depending on the roles assigned, people can bypass the password.

For example, I put a password on a return, and because I'm an admin, I don't have to enter the password. However, the return is still restricted for everyone else who doesn't have admin access. 

Does that help?