Preventing full desktop session login when just using app remoting

Case as follows: We have some smart users who just figure out the name of the WVD session host from a remote app they use. What they do next is just fire off mstsc.exe to that session host and then...