Need to deny DML access through SSMS using web app credentials
The behavior of a role can't be defined by the application being used. 

There are a couple of approaches that might work, but both will require code changes:


Enforce all data manipulation to go through stored procedures (you can grant execute to the app credentials and deny direct insert/update/delete). The app would call the stored procedures. To ensure users aren't calling the procedures directly in SSMS (or from their own VBScripts or other local code), the procedures could check APP_NAME() to decide whether or not to proceed.
If you can't enforce all data manipulation through stored procedures, then you could have INSTEAD OF triggers on all (or the most important) tables, which would perform a similar check against APP_NAME(), and then either perform the operation or not.


Keep in mind that the application name can be spoofed, so anything that relies on the output of APP_NAME() is vulnerable to tampering.

A more foolproof way would be to create separate logins altogether - better guard the credentials for the app, which you trust, from your developers, who you don't. (And as TomV mentions below, use Windows authentication for the app, so developers will have a much harder time pretending to act on its behalf.)