How will we implement the security in the SharePoint hosted app which deployed on SharePoint online?

Question

In our project, users will allow to upload the document only through the app and will have also provided links in apps to directly download the file

e.g :

https://zzzz.sharepoint.com/sites/zzz/DMSDocument/1027/091CHEN030006931456/test.doc.

But they can't directly upload any document through below URL

https://zzzz.sharepoint.com/sites/zzz/DMSDocument/Forms/AllItems.aspx

I have set the custom permission level in which the following roles are unchecked

• View Application Pages( View forms, views and application pages,Enumerated lists)

In this way, I can stop user to directly to go ALLitems.aspx page, but he can't download the document by the above-mentioned link.

How can achieve this security in a better way?