Using Windows authentication, is there a way to prohibit users from connecting via ODBC to the database?
The feature designed to help in this scenario is Application Roles. With an Application Role you can allow the user to connect to the target database, but not be able to run any queries until the application supplies a secret to activate the Application Role.
A possible solution is to create a server logon trigger that would check the
app_name(). I created the following server trigger on my local instance and tried to connect via ODBC. The connection was rejected. You would have to modify for your needs.
CREATE TRIGGER trgGetAppName ON ALL SERVER FOR LOGON AS IF APP_NAME() NOT LIKE ('Microsoft SQL Server Management Studio%') AND APP_NAME() NOT LIKE ('.Net SqlClient Data Provider%') BEGIN ROLLBACK END
A word of caution about logon triggers:
A logon trigger can effectively prevent successful connections to the Database Engine for all users, including members of the sysadmin fixed server role. When a logon trigger is preventing connections, members of the sysadmin fixed server role can connect by using the dedicated administrator connection, or by starting the Database Engine in minimal configuration mode (-f)