Is it possible to restrict SQL Server DB_Owner when connecting using SQL Server Mgt Studio?
Changing this EXE program seems to be out of the question


That makes using application roles not an option. However, here's the link anyway since it's good to know: Application roles

Your second option would be using logon triggers. Link for more info
What you do is, once somebody logs in, you check which application name they are using and if it's not your EXE, you deny access by aborting the logon..

However, this is not bullet proof since the "application" string can be spoofed. It might however be "good enough" for stopping the curious people.

Security should be designed in such a way that people that are able to log in to a database can only do what they are allowed to do. So your best option (but the most complicated to implement at this stage) Would be to revoke the DBO permission an give more granular permissions. If you need business logic to be forced your only option is to implement that in stored procedures and only give execute permissions to those stored procedures.. However, that might again mean chaning the EXE.