In the htaccess file in your web directory (the /web/.htaccess file), add these rules right beneath the RewriteEngine On:
RewriteCond %{THE_REQUEST} ^(GET|HEAD)\ /web/RewriteRule ^(.*)$ /$1 [L,R=301]
This redirects all direct access to the web directory to the root.