If you can access your own web space the best approach will be to separate the two requirements: creating a virtual tour, and making it available only to certain people.
1. Create your virtual tour using any up-to-date industry-standard tool. I suggest Pano2VR, but there are others.
2. Upload the finished tour to a directory on your site and work out whatever level of web-based security you prefer. This can be simply putting the tour into a directory that doesn’t have public links into it (‘security through obscurity’), slightly more pro-active JavaScript password scripts, all the way to server-level htaccess name/password access control.