SharePoint restriction take place at file level, once the file is obtained somehow, there is nothing SP can do to restrict operation at application level.
Active Directory Rights Management Services (AD RMS) for on-premise scenarios and Azure Rights Management are currently offered by MS and fully supported by SharePoint & Office apps.
The best part of RMS is that even printscreening could be turned off.
Alternatively, PDF offers some kind of serverless operations restriction - password based. I've seen the requirement similar to yours been implemented thru converting DOCX to print-protected PDF inside SharePoint workflow.
Setting up AD RMS is relatively easy, but requires some DR planning because losing the service forever could make protected documents unopenable forever. Also, AFAIK there are some licensing requirements.