How to prevent user from connecting via SSMS but allow query via .net application connectionstring?

Question

I have been given task to create a SQL login that can be used to query the db via a .net application connection string.

But the user shouldn't be able to connect to SQL via SSMS.

I have created the SQL login and given it datareader permission on the database.

If I grant SELECT, and deny CONNECT, then technically the account won't be able to query via connection string.

Same if I disable the login or remove permission to connect to database engine.

Is there any way to achieve this?