The official way would be to assign the Bundles to the Users and not the Device.

--

While I've never actually done it, You should be able to set a SYSREQ for the Registry Key "ConsoleUserName" to exist on a bundle.  This only exists if a user is logged into ZCM.  I'm not sure if there would be timing issues such as the Key is not there when ZCM checks system requirements.  If you had a timing issue then something such as tweaking the Delayed Refresh from 300-360 down to something like 15-20 would likey avoid that.  The long delay is no longer necessary....It's an old default from when ZENworks Refreshes were very inefficient ages ago.

--

I could do something with ZESM so the Device has a ZESM Policy to Prevent ZAPP.exe from running, but a User Assigned Policy Permitted it.  Thus ZAPP could only run if logged into ZCM.  Again....It would take testing as I've never tried this since traditionally all this is handled via how assignments are made.