the desktop client tries to get authorization via /index.php/login/v2/grant
you can put this inside your Apache-vhost-config (.htaccess would work too)
RewriteCond %{REQUEST_URI} ^/index.php/login/v2/grant
RewriteRule ^(.*)$ https://example.com/index.php/login [L,R=301]
and some more conditions for the Android client
RewriteCond %{REQUEST_URI} ^/index.php/login/flow/grant(.)$ [OR]
RewriteCond %{REQUEST_URI} ^/core/js/login/grant(.)$ [OR]
RewriteCond %{REQUEST_URI} ^/index.php/login/flow/grant(.)$
RewriteRule ^(.)$ https://example.com/index.php/login [L,R=403]
this only prohibits the android client to authenticate at first login! If the client was already registered, it won’t stop that connection.