Use a custom content locker, which after the conversion, will redirect the user to the download link!
By blanking the referer in the custom locker, you can make sure, your CPA network, will not know where your traffic comes from, and you will be safe.