There is no way any cryptographic tool of any kind will protect a file against alterations. At best, such tools will make alteration detectable in a way that an hostile entity will not be able to hid.
"Detectable" means that it will be detected by somebody. Depending on who you want that somebody to be, various tools are to be applied. A MAC is computed with a secret key, and the same key is used to verify it; so, if you use a MAC, then whoever can verify that the file is unaltered also has all the technical power need to actually alter the file and still avoid detection. If you want verifiers to be distinct from provers (the "prover" is the one who states "this is the correct file" in the first place), then you will need digital signatures.
None of this would prevent a hacker who has taken control of your server from modifying the file on the server. At best, users who download the file and verify the signature may notice that something is amiss. Moreover, signatures on files require some tools to verify them. This can be done relatively easily in PDF files because the PDF format includes provisions for signatures and the usual PDF reader, namely Acrobat Reader from Adobe, includes the necessary code. It still requires some user education, so that the users get alarmed if the PDF they download turns out not to be signed.
TO prevent a hacker from modifying the file on the server, then forget all this talk about signatures and MAC and whatsnot; just make sure that your server cannot be hijacked by outsider. This is the realm of system administration, vulnerabilities and patches, and firewalls. To avoid alterations in transit, just make your server use SSL (i.e. "HTTPS").