1. Is .htaccess the best way to do this, or does Zen Cart have something built-in?
2. Will password-protecting a Zen Cart site affect its operation in any way?
To totally protect the site, the .htaccess is the most protection, though the cart does have Down fr Maintenance mode that doesn't allow wnyone in unless you have their IP added as an exception. (configurable form the Admin)

Password protecting or using Down for Maintenance will not allow many payment and shipping modules to communicate with the cart. You should be able to do all of your Template customization and most testing with the site protected.