A common request we get from customers it how they can block many problematic or unauthorized (and uncontrolled) email clients connecting to their Exchange servers via Exchange Web Services

Exchange 2010 SP1 - Rejoice!
Thankfully Microsoft heard the feedback loud and clear, and beginning with Exchange 2010 SP1, this is highly manageable via new block and allow settings and lists that can be applied at an organizational or mailbox level!

The two commands used:
set-organizationconfig
and
set-casmailbox

Note: Settings enabled/configured at the organization level are overridden by those at the mailbox level. This means you are able to enforce a secure policy by default, then just make a few exceptions for users. 

The most common configuration we setup for client is as follows: