Which of WordPress’s .php files need to be directly accessible via HTTP?

Correct me if I’m wrong, but far as I know, You don’t access directly to any of the files, the apache user does. Meaning, the user browser talks to the server’s httpd process which will get the file from the filesystem.
So, i think that if you get a 404 on the browser when directly requesting a file, you will get the same 404 error when using the links on the wordpress pages.

I understand your point, I just don’t know if it is possible.

About blocking requests based on the address, I think you should look at the specs of the .htaccess file. The WordPress uses this file to config the permalinks.