Not exactly, you always have the good old fallback of unpublishing the public DNS record and using a hosts entry for periods. It will break Let’s Encrypt if you rebuild while public DNS is absent, but otherwise it works. Users would need to know the new DNS name AND IP address to access it.
Disabling accounts is an option, but there’s also an option to disable all email in /admin which is probably prudent.
As a thought, you can also control access from one more layer by implementing your own IdM/SSO. More work, but potentially huge payoffs in other areas down the line. All depends what you’re comfortable with.