Dave,
Unfortunately, I'm afraid that the files have to be in the public folder of a user's Dropbox account, to be accessible through a calibre2opds catalog. It's simply that all the links are relative, and the client software needs to be able to guess the URL of a file relative to another one (e.g., a book file relative to the catalog) ; Dropbox creates "encrypted" URLs for the private files, which are not at all related to one another.
If anybody has a solution for this, I'm all ears
All best,
David.