Short answer: share the chapters with Can view (listen-only) permission, so the rights holder can play every chapter in the browser but can't download the files. When the payment comes in, turn on downloads and they can take the finished files.
When you work directly with a rights holder instead of through ACX, nothing holds the files back until you're paid. A shared cloud folder usually hands over the finished masters the moment you send the link. Keeping the final files until the invoice is paid in full is ordinary business practice. It doesn't mean you distrust the client.
Notetracks is where the chapters live while the book is being finished. You upload each chapter to one project, proof it with notes pinned to exact timestamps, fix the pickups in your editor, and share the project with the rights holder when it's ready for them to hear.
Because every note sits on the waveform at the moment it refers to, nobody has to write "around 14 minutes into chapter 3, the second time she says the name".

Notes can be replied to and reacted to, so if someone else is proofing with you, the back-and-forth about a fix stays on the note instead of in an email thread.

When proofing is done, export the notes and import them into your audio editor, so every pickup lands on your timeline at the right spot. There are step-by-step guides for Adobe Audition, Audacity and REAPER.

Once the pickups are fixed, upload the corrected chapter to the same project and share it with the rights holder.

When the invoice is settled, open the project's share settings and enable downloads for the rights holder. They can then download the final chapter files from the same project. There's nothing new to upload and no second link to send.
Yes. Anything that plays on a screen can be recorded, so listen-only sharing isn't copy protection. What it does is keep the clean, full-quality files in your hands until you've been paid. A genuine client who just wants to check the chapters won't need anything more than the player.
No, this is for working directly with a rights holder outside ACX. On ACX, uploads and approvals happen inside the ACX platform.
Yes. Invite them with Can comment instead of Can view. They can listen and leave notes at exact timestamps for any pickups they want, and they still can't download the files until you turn downloads on. See what each share permission allows.
Yes. The project owner can unshare the project at any time.
More on proofing: how to proof an audiobook or voice-over recording, including labels and the Draw tools.