sql auth vs nt auth in SQL server
Ok, so everything I read says best practice is to us NT authentication in SQL 
  server


Read more. Please. Because while there are good reasons to do that in certain scenarios, there are good reasons NOT to do it in other scenarios.


  And I can see some advantages to that but using NT auth how do I force users
  to access the data using only my application and not some other tool such as 
  SSMS?


Since maybe 25 years or so a standard approach to program applications is to have a SERVER. The user connects to the SERVER and ONLY the server connects to the database. Problem solved.


  Am I missing something here?


Stating the obvious: A lot more reading than you did so far.


  Is there a way to block SSMS and other database tools from connecting to my 
  application's database?


Your reading did not get to application passwords in the documentation (https://msdn.microsoft.com/en-us/library/ms181491.aspx is titled CREATE APPLICATION ROLE) which would allow an application to post-authenticate with a password. Not that this is a good approach - but it sis AN approach that was introduce some versions back. This way rights could be on an application, and unless the user knows the role password of the application - out of luck.

But really, the standard approach is to use an application server and only the app server can connect. And often this does not use NT authentication as the connection password is coded in a server config file.