how to push users to log on to appl.server and prevent to log on to db serv

Hello

I wander how to push users to log on to application server and prevent users to log on to database server. One possibility I see is using log-on groups(which does not contain database server).

Is there any other solution

thx in advance