The existing 'has restricted view' space role can export data to Excel. If you do not wish for users with the 'has restricted view' space role to be able to export data, you will need to edit the User Default role to deny download for all users, and then create a custom role that allows it for specific users and groups.
Steps
Go to the Administration activity center
Go to Manage users
Go to Permissions
Click User Default
Expand Content Types
Expand Applications
Set In-app content download to Not Allowed
Click Confirm
This has now changed the default user behavior across the tenant. Users will no longer be able to download in-app content.
Back in the Permissions view, click Create New
This creates a new role that you will need to assign to any users who should have the permission to download in-app content.