Try something like this in the webserver configuration (Location
does not work in the .htaccess
)
<Location /en>
Require valid-user
AuthType basic
AuthName "Protected shop"
AuthUserFile /your/path/.htpasswd
</Location>
See here https://stackoverflow.com/a/580067/288568
If you don't have access to the web server vhost configuration, you can use something like
SetEnvIf Request_URI "/en/.*" DENY
edit
Use
SetEnvIf Request_URI "/en.*" DENY
to match also the homepage.
in the .htaccess
to define an env variable and DENY access based on this.
I recommend to use the web-server configuration (if possible) because it's easier to read.