More than likely, what you have done is enable to password feature, but then allowed "Everyone" access to the folder itself.  What you are going to need to do is goto the actual folder on the harddrive, right-click and select properties, then jump over to the security tab and remove every user you see there, then just add back the users that you wish to have access.  I would probably recommend adding back your local user account as well.  Also, I would probably only give the users accessing it from the web read and list permissions.  Also, in the security settings of IIS use Basic authentication, remove integrated windows authentication, put your machine name as the domain and for realm you can enter anything you want.

You do not need to be in a domain for this to work, you just need to setup user accounts on the local machine.  And do not goto the sharing tab, use the permissions section and add the users you created with the permissions you need.  When when the user is prompted to logon they will have the file permissions that you set.