I'm thinking my two best option are:

Remove sysadmin access and lock down the views/functions/certs/keys

or

Get some kind of external solution programmed

As you mentioned I'd rather get the sysadmin access toned down,...

The applications themselves or their accounts only go as high as dbo in the databases. However, for other reasons there are accounts that have sysadmin access that are not tied...