Use a session-based permission set to allow functional access only during a predefined session type.

Flows or SOAP API can be used to activate and deactivate the session-based permission set.

Flow Components to Activate and Deactivate the permission Set