Can SQL server deny connections until the AG failover has completed ?
There is not a built in option to do this directly from AlwaysOn.  You would have to go with something a bit custom.  Depending on your setup, you could do something as simple as a job or a trigger scanning for changes in alwayson state.  Which then disables/enables the login for the application during a failover. But then you may see other errors in your log for the failed login attempt.