The scenario is possible to achieve using multiple mechanisms.
1) Sitecore security on items (unauthenticated users will have no way of accessing the pages).
SXA fully respects the Sitecore security model and you could simply revoke the read rights to everyone for the restricted items and grant it selectively to the authenticated users. The component will render the items with respect to what the Sitecore API returns.
2) Personalization + navigation filters. (if you want pages to be reachable for unauthorized users just not showing in navigation) Have 2 navigations in your header and show one for authenticated users and another one for anonymous visitors.
Add one or two navigation filters under //Data/Navigation Filters like this:
On the page you want to hide for anonymous visitors check the checkbox to filter the page out:
In the navigation that personalization shows to anonymous visitors pick the "Anonymous visitors" filter:
3) Last option requires that you have SXA 1.3 and in this option simply specify the personalization rule on your rendering variant. This allows you to evaluate each item before it's rendered and you can set any personalization rule there:
That means you can have various fields and say e.g.
if this field has that value and user is in this profile card - show
if this item is of that template and user is returning - show