Make "original" images unaccessable?
Since all asset transforms are saved in a sub-directory starting with an underscore, you could simply test for that.


  Original:
  /assets/folder/house.png
  
  Transforms:
  /assets/folder/_900x500/house.png
  /assets/folder/_thumb/house.png


Plugin:

If your asset-folder is above public_html, and the request is routed through Craft, you could create a plugin, which checks for the underscore:

public function init()
{
    parent::init();

    //Is resource request?
    if (craft()-&gt;request-&gt;isResourceRequest()) {

        //Parent directory
        $parent_dir = dirname(craft()-&gt;request-&gt;getUrl());

        //Check if parent dir doesn't beginns with an underscore
        if (!preg_match('/^[\/\\]*([_]+)/U', $parent_dir)) {
            exit(403);
        }
    }
}


.htaccess:

If your assets can be accessed directly, you'd have to use .htaccess to deny the request. I'm really bad at RewriteConditions, so this would possible be a question for StackOverflow.