In Zimbra 10, you can restrict users from accessing webmail. To do this, you can simply disable the Zimbra web client feature. Below are the steps to do so
Disable Zimbra web client feature
su - zimbra zmprov ma user@domain zimbraFeatureWebClientEnabled FALSE
You can also disable based on CoS
su - zimbra zmprov mc cos-name zimbraFeatureWebClientEnabled FALSE
Note: Change cos-name with your CoS.
Below is the result when user login from webmail
Good luck 🙂