It depends on how, exactly, the application interacts with the file and the user.
The root question is: "Is there a way to use a different security principal that the one from the user login session to access the file" ? If the answer is "no", then you can't restrict it.
More pragmatically:
If the application is a traditional desktop application used either remotely (application running on the client's computer accessing the file through a SMB share) or locally (for instance through Terminal Services), then no, you usually cannot restrict the access to the file using permissions because the process uses the user's identity to access it.
If the application is a n-tier application (for instance, a web app), then you usually can put extra restriction on data file access: you restrict the rights of the users and allow whatever level of access is necessary to the security principal that will be used (that's usually done by assigning a specific service service account to the relevant process). Be mindful, however, of the fact that it is possible for a n-tier application to impersonate the user access token. In such a case, you should make sure that the files you want to protect are, in fact, not available though SMB at all (for instance, by placing them into a drive or folder that is not accessible from any SMB share available to the users).
Note that, regardless of what the answer to the above it, if the application supports UNC path, you could make it less likely for the user to access the file by hiding it under a hidden network share. All you need to do to hide the share is to add a dollar sign ($) at the end of it's name. It will not prevent anyone but the less tech-savvy users from acessing the file should they want it but it might prevent accidents.