The biggest problem is first determining for certain which clients are java and whcih arnt, then which are an authorized oper since the user wont ahve /oper'ed at that point anyway.
There really is nothing that can be done about it other than not giving out the address to your net... There really is no way to force people to use 1 client only and I honestly don't see why you would want to restrict people to Java...
With not giving out the servers address, the java client still needs to know which server to connect to so that would make the info available to end users.
Even if the server name was hard coded into the java applet, there are many utilities that can show incoming and outgoing connections to and from your computer and which IP and ports theyre to and from.
Only other thing i can suggest is a server password in your allow blocks, but again that still has to be givern to the java applet at some point.
One more crazy solution for `the only on client`: mIRC is sending
-> NICK Yournick
-> USER ident "yourhostname" "server.name" :Realname
You can write your own module to disconnect users if they are sending something that not match this introduction schema.