Just to add what Andreas says. There are various ways you can set up the server so that they cannot connect directly to SQL Server from Excel. However, it is unlikely that this will address you particular concerns. If you only expose the data through the application, you have better control of what data they can see and modify.

But no matter how you expose the data, users will expose to get it in a grid, so that they can export it to Excel. And once it's there, they can do all sorts of with it which they should not do.