The no no about loading wp-* files directly are reasonable when you are developing a WordPress plugin or theme, but if you are developing an external code that require WP (and that seems your case) than you must require that files, there is no alternatives.
Consider that including wp-blog-header.php is needed when you need to handle WordPress urls, or full WordPress frontend, but when you need WordPress features, including wp-load.php is better and faster, and no need to $wp->init();.
Also, setting SHORTINIT constant to true make the load faster, but doing so some features of WordPress are not available, and the user checking is one of them.
However, requiring few files, and calling a couple of functions you will be able to check user capabilities:
<?php
define( 'SHORTINIT', 1 );
require '../wp-load.php'; // adjust according to your paths
require ABSPATH . WPINC . '/formatting.php';
require ABSPATH . WPINC . '/capabilities.php';
require ABSPATH . WPINC . '/user.php';
require ABSPATH . WPINC . '/meta.php';
require ABSPATH . WPINC . '/post.php';
require ABSPATH . WPINC . '/pluggable.php';
wp_plugin_directory_constants();
wp_cookie_constants();
if( current_user_can( 'manage_options' ) ) { // check capability
$GLOBALS = array(); // free some memory
// require your file here
} else {
header("HTTP/1.1 401 Unauthorized");
exit;
}