We have a legacy application which has data and PDF files available on a network share, and a locally-installed EXE to run it. The EXE uses a UNC path to access the data and PDFs.
The customer is concerned that users can access the data and PDFs outside the application.
Question: Is it possible, via Group Policy, third-party applications or whatever, to restrict Windows Explorer, CMD.EXE and so on from accessing this shared location while still allowing the application to access it?
Short answer is no, but you can restrict access beyond the authentication/authorization methods avaiable within whatever network file system protocol you are using (probably SMB since you've mentioned .EXE files and windows-explorer).
See discussion on Building a Student Storage server