DB Security vs. Application

We are rolling out mssqlxpress to our development staff and would prefer to alter their permissions so that they can only make changes using mssqlxpress (since it integrates nicely with VSS).

So are choices are to uninstall SQL Enterprise Manager and SQL Query Analyzer, or more preferably, alter their NT Permissions so that they do not have the capability to change anything in the DB's.

My concern is that it seems we can only set their permissions from DB level and not the application, does that sound correct? Has anyone else had to deal with this predicament and is there an alternative to uninstalling the SQL Client tools?Look into Application Roles topic in BOL, maybe you can specify this source control app as the only app with required permissions, and modify your connection object within the app to use this role. At the same time you revoke all permissions from all individual users in question.