[redhead]

Not sure if this is the way you want to do it, but you could have:

Listen 80
Listen 10000
NameVirtualHost 12.34.56.78:80
NameVirtualHost 12.34.56.78:10000 

<VirtualHost _default_:80>
    ServerAdmin web@domain.com
    DocumentRoot /var/www/open
    ServerName open.domain.com
    ServerAlias open
    ErrorLog logs/open-error.log
    CustomLog logs/open-access.log combined
    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/var/www/open">
       Options Indexes FollowSymLinks MultiViews
       AllowOverride None
       Order allow,deny
       Allow from all
    </Directory>
</VirtualHost>

<VirtualHost _default_:10000>
    ServerAdmin web@domain.com
    DocumentRoot /var/www/hidden
    ServerName hide_me.domain.com
    ServerAlias hide_me
    ErrorLog logs/hide_me-error.log
    CustomLog logs/hide_me-access.log combined
    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/var/www/hide_me">
       Options Indexes FollowSymLinks MultiViews
       AllowOverride All
       Order allow,deny
       Allow from all
    </Directory>
</VirtualHost>

in your httpd.conf file, if a user is requesting port 10000, then they are directed to a directory, where .htaccess has full control, if its a normal request on port 80, they are directed to a directory, where .htaccess has no permission

I dont know if it is possible to set the same DocumentRoot in both entries or not, since this is an issue I've never tried myself.