Conditional access office applications
In "Settings" > "Fileservers" you can set the configuration of the desired File server. The "Office local apps" section is the place where you configure possible restrictions for accessing office applications locally.
With IP "whitelist" and "blacklist" you can choose on which IP range(s) launching local office apps are available. This way you can only make it available from trusted IP ranges e.g. the company network.
When a user doesn't meet the IP standards only the "Open in Word Online" option will show.