I'm not sure you can do that if they really want to move the data away. You might be able to prevent running
sftp, but that still leaves many other ways of transferring files.
First, the really simple file transfer protocol is this:
ssh user@hostname 'cat /some/remote/file' > /some/local/path
And you can replace
cat with almost any program, heck, even
cp somefile /dev/stdout seems to work.
In the comments there were suggestions about disconnecting sessions after a particular time or after a particular amount of data transferred. That seems to work on the surface, if you also limit the number of connections the user can make. Allowing 10 connections a day, with a limit of 1 MB / connection, would limit them to moving just 10 MB. Perhaps something like that could be made to work if the normal intended use requires much less data transfer than the unwanted scenario.
But what if they just send the file somewhere else? It should be easy to set up an SSH/FTP/whatever server somewhere else and send the file through that. Or via HTTP(S), at least
curl has options like
--data @filename and
--upload-file, and setting up the server side shouldn't be hard. If you remove the already existing tools, what if the program they run on the system sends the data away while/instead of processing it?
What you would need to do, is to limit what the program having access to the data can do with some kind of a sandbox.
Arrange for the code to run in a virtual machine that has no access to the outside, other than some interface for uploading the code and downloading the results, with appropriate controls for what gets accepted as a valid upload and a valid result. Or use somthing like
seccomp to limit what the code can do.