Prevent Sa user from remote login

I think you should specify the reason why you want this. Then we could lead you to a better path.

As far as how it could be done is, At the moment I can only think of a DDL LOGON TRIGGER as the solution

You could try something like this in the LOGON TRIGGER

IF SUSER_SNAME() = 'sa'
BEGIN
IF HOST_NAME() <> 'YOURSERVERNAME'
ROLLBACK
END

OR

DECLARE @Ipadress VARCHAR(48)
IF SUSER_SNAME() = 'sa'
BEGIN
        SELECT  @Ipadress = [client_net_address]
        FROM    sys.[dm_exec_connections]
        WHERE   [session_id] = @@SPID

       IF @Ipadress NOT IN ( '<local machine>', 'YOURSERVERIP') 
            ROLLBACK
END

Hope it will help your cause, but please do let us know why you want it.

Your best solution to prevent remote login by the 'sa' account is to change the password and stop letting people use it. Security wise, this account should not be used for day-to-day activity.

If access is required by a user or application, a dedicated account should be created so you know who is doing what in your system.