Answering part of my own question, in case it helps others... haven't found a way to have an unprotected subfolder under a password-protected root; but a workaround to manually renew the certificates is as follows (all in Plesk)
Go to Password Protected directories
Click on the name of the...
I have a site hosted on Windows with Plesk. I need to both password-protect the root folder, but also wish to use "Let's Encrypt" SSL encryption. Once the password protection is on, attempts to renew the certificate fail because the request to the challenge in /.well-known folder is forbidden...