The static preview and live sites are accessible to anyone who has the URL by default. However, it is also possible to add HTTP Auth password protection to each of them, as specified below.
Login to your Strattic dashboard
Then click on the "Details" button
Click the tab of the environment you wish to protect.
Preview Site Connection Info or
Live Site Connection Info
In the Site Protection setting, check to enable the HTTP Authentication. It will start updating, this may take a few minutes.
The HTTP (Basic Auth) credentials will be displayed once it has been enabled.