Programmatically redirect users to the default "access restricted"
You can throw an exception at any point in your code:

403:

throw new \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException();


404:

throw new \Symfony\Component\HttpKernel\Exception\NotFoundHttpException();


The exception is then catched by DefaultExceptionHtmlSubscriber and a subrequest for /system/403 or /system/404 is returned, which you can configure in the basic site settings if you don't want to display a generic "access denied" or "not found" page.

Other options depend on where the code is placed:


Return a 403 or 404 response from a controller or a form
Set a response in an event if you are in an event subscriber.


What you should never do is to send a response directly. This doesn't stop the code and produces two responses, one you've sent and one returned by the Drupal kernel. This will result in unpredictable behavior.