You *could* do something using a trigger, but it can be subverted without too much trouble, eg here's one to get you started

CREATE OR REPLACE TRIGGER SYS.SECURE__ACCESS
after logon on database
declare
  l_program v$session.program%type;
  l_osuser  v$session.osuser%type;
  l_machine v$session.machine%type;
  l_user    varchar2(30) := user;

  l_instance v$instance.instance_name%type := sys_context('USERENV','INSTANCE_NAME');

begin
    if l_user = 'MY_USER' then

      select osuser, machine, program
      into   l_osuser, l_machine, l_program
      from   v$session
      where  sid = sys_context('USERENV','SID');

      if ( lower(l_program) like '%toad%' ) 
         and lower(l_machine) not like '%special%'  
      then

        select count(*)
        into   l_is_dba
        from   dba_role_privs
        where  grantee = upper(l_osuser)
        and    granted_role = 'DBA';

        if l_is_dba = 0 then
          raise_application_error(-20999,'This account is limited etc etc');
        end if;
      end if;

    end if;

exception
  when no_data_found then null;
  when too_many_rows then null;
end;
/

but of course a savvy user will rename their toad.exe to something else.

I've seen solutions more complex than this, namely, submit a job on login which will then look for the typical open cursors that TOAD will have, and then kill that session...but that seems overkill