You cannot do this securely. It is a fundamentally broken approach. You need contextual information about the application and the filesystem, which you cannot gain from an external perspective. The best you can do is deploy a WAF such as Apache's mod_security and enable a bunch of path traversal rules to try to block path traversal attempts, but a determined attacker will eventually find a way around those rules.
If someone has given you this task, consider that the first step in any task is to perform a feasibility study. You work out if the task is possible, what the approaches are and what benefits and drawbacks they have, then you do a cost-benefit analysis. In this case the primary cost is risk. I suggest that you go back to whoever gave you that task and explain that you technically can do this, but it's a blacklist approach that isn't ironclad and it will involve standing up some additional infrastructure in front of the web server (and that means maintaining and patching it too, particularly the WAF part!). Then you can leave it to them to weigh those costs up against a more complete solution, such as getting the web application actually fixed.
If the web application in question is made by a third party, report the directory traversal as a security vulnerability. If it's a product or service that they sell, you can use responsible disclosure to push them to fix it if they're slow about it. If the web application is something that your organisation contracted a third party to make for you, you can check the contract to see if they are liable for fixing security vulnerabilities (you should also write this into your contracts!)