Matt,
I apologize if I am not grasping your problem completely, but it sounded to me like the issue that I was having initially, so here’s what I did…
I use the s2Member ‘level’ as the “category” of product, and custom capabilities (ccaps) as specific product or product group purchases.
For example, I might use “level 1” for purchase of certain training videos, then custom capabilities for purchase of beginner or advanced topics under that category. The nice thing is that in generating your PayPal buttons you can specify which ccaps should be assigned to that purchase in addition to the level.
Next, some very simple shortcodes on the members page and on the category page will allow paid-for links to show up.
Finally, be sure to protect the deliverables pages themselves with both the membership level AND the custom capabilities so that simply specifying a valid URL will not end-run around your protection.