IIS如何阻止来自浏览器的http请求

In Windows domain, Sliver-light out-of-browser app(used by many user) consuming a couple of WCF services hosted on IIS. Now users know WCF service endpoints, they might able to execute methods without Sliver-light App. So is that possible IIS can identify http request from browser or Sliver-light out-of-browser App then block all requests from browser but only allow http request from Sliver-light app?add IP Security on IIS not an option as that will block user use Sliver-light app, and add PrincipalPermission attribute on WCF not an option as well because need too many domain user group and WCF methos need to handle.In Windows domain, Sliver-light out-of-browser