I'm not sure what you mean.

If you are running something on your client, it does have to have some way of getting the file, whether that's ftp, http, or other, so you are going to be exposing the server.

If you are talking about a script that runs on the server and provides the program to the client, that would presumably be a script running under your webserver, but so they'd need to be able to access the webserver.