If you were to rename the file to a different extension that's not a common extension for the web, you could still read it from index.php, but you can deny access from web. Apache allows this configuration and by default, only well-known web extensions (php, php5, htm, html, etc.) are allowed, because those map to well-known handlers (i.e. php will be processed by a php processor, etc.) These are defined in httpd.conf file and it is best for you to just open up that file and see which extensions are already registered. You might also want to avoid other common extensions that may not be there yet, but could come in the future.
Just rename it to something like backend_file.internalonly, and that should most likely solve the issue.
Another option is to move the file out of the public_html (or www) folder if you can. However, I prefer different extensions simply so I can keep the file in a given folder.
If this file has sensitive data (instead of just some shared code that you don't want to be hit from outside), then I would move it out of the public_html folder completely, instead of trying to get into access control related solutions (which are harder to get right, and test.)