If you want to keep the user but cut off access, you can assign them a blank role with no access permissions. That way if they do log in, they won't be able to access anything. Assigning an "Inactive User" Role to all users you want to remove access for can also help you to quickly see who once had access in your instance.