reject queries based on specific client_app_name and nt_username
Yes, you can use a Logon Trigger and call ROLLBACK if you want to deny the logon.

Alternatively if you are on Enterprise Edition you could use these in a resource governor classifier function to route them to a workload group in a resource pool with limited resources.

Note the app_name() is potentially easily settable from the client if they are making adhoc connections, e.g. via SSMS, or can edit the connection string used by your app.