How to restrict table access to a application
For the security credential/context which the application uses to authenticate to the DB, set an EXPLICIT DENY to it on the table to not allow it to access it at all (e.g. SELECT, UDPATE, DELETE, etc.).

You should really have the application credential locked down in the DB which it uses anyway to ONLY allow it to ONLY have the EXPLICIT level of access it needs to each DB object specifically in the name of security.

So why the user table is a concern now, wonder what other tables, etc. it has access to due to poor security design.