Is there an app that won't let workers clock in unless they're on site?
Yes, that's what geolocation mode does. Each site has a geofence with a radius in meters, and a punch from outside it doesn't go through. If refusing it would stop real work, turn on "clock in anyway": the punch is saved and flagged to the admin instead of blocked.