The error you show indicates S3 is requiring an authorization token to serve your file. This is exactly as it should be. If you allow documents to be "public-read" in S3, then there is backdoor access that renders the document privacy options useless.

Do you want all documents to download? or do you want some, such as PDFs, to display in the browser? If you want all to download, I would start by setting WAGTAILDOCS_INLINE_CONTENT_TYPES to an empty list. That may only work for references within rich text. If so, you may need to set the WAGTAILDOCS_SERVE_METHOD to "serve" and override the document serve method to set the content disposition header to attachment.