Today, the Alfresco Explorer web client (aka, the "alfresco app") is munged together with the repository. They cannot be easily separated, although this is something we'd like to do.
The Share web application communicates with the web application, so if you decide to use web server or network configuration to block access to /alfresco, remember that the /share web application needs to be able to hit it via HTTP. Similarly, if you have written other applications that use CMIS or another remote API, those apps will also need access to the /alfresco web app.
