Since you're using 2008, you could create a logon trigger that checks which application they're trying to logon from. You'll need to take some care because you could end up preventing logons by anyone. Develop such a thing on a test server and test like crazy before you put it in prod.
--Jeff Moden
Change is inevitable... Change for the better is not.