“How can we protect documents that users might download from SharePoint?”
You need Information Rights Management (IRM) service – now available in some Office 365/SharePoint online plans
And now some resources to get you started if you have SharePoint Online (2013) .
Third party Articles
Related Microsoft Article
SharePoint Online Service Description covers SharePoint feature availability