What is the best way to restrict website's direct access through node urls?
Using the Rules module you can implement a rule that looks similar to this:

{ "rules_check_url" : {
    "LABEL" : "Disallow node/* access",
    "PLUGIN" : "reaction rule",
    "OWNER" : "rules",
    "REQUIRES" : [ "rules" ],
    "ON" : { "init" : [] },
    "IF" : [
      { "text_matches" : {
          "text" : [ "site:current-page:url" ],
          "match" : "node\/\\d+$",
          "operation" : "regex"
        }
      }
    ],
    "DO" : [
      { "drupal_message" : {
          "message" : "Sorry, URLs like [site:current-page:url] are not allowed around here ...",
          "type" : "error"
        }
      },
      { "redirect" : { "url" : "no_access" } }
    ]
  }
}


It assumes you'll have a node with a path like no_access (which is where a user trying to use node/xxx will be rerouted to). Feel free to adapt to any other path that fits).

The above rule does not (yet) take into account to only apply the "action" for selected user roles. E.g.: you may want such paths to be used (allowed) anyway for roles like 'administrator' or 'content-editor'. But for anybody a bit familiar with the Rules module, that is a straight forward "Condition" to add.

To experiment with this rule in your own site, just copy the entire Rules code above, and paste it in a new Rule in your own site, created via the "Import" function. Then further edit/refine to make it fit in your own environment (eg the "Sorry, ..." message to be shown.

If you have to still install the Rules module, you'll discover tons of other use cases to also be resolved by the same Rules module (possibly complemented with the Flag module soon ...)