I have the same use case. Users who should no longer be able to login (we can solve this at the SSO layer though) and they should not be receiving any emails. Ideally we keep their username though and if they ever become eligible again, they rejoin as if nothing happened