programmatic file download from box.com (by non-box user)

I am new to box APIs. I spent hours on box.com figuring out one simple thing.
=> How can I enable a "external user with no-box-account" to download a file/folder programmatically?
Programmatic => curl command, python command.
.
Answers that I found involved:
1) A curl command involving access token (-H "Authorization..."). To create access token, I have to create custom app(please correct me).
But if I do that. the user will have access to ALL my files in our box account. Application scope in custom app section do NOT allow me to restrict the APP clientid/secret usage to access only 1 particular folder/file.

2) I found that external users can be added and be restricted at folder level in admin panel (Add External User).
Is there a client_id/secret for this external user which I can provide to him/her to access our box folder/files using programmatic APIS - curl/python?

3) Why does not curl work on shared URL link?
curl -L https://box.shared.link