How to disable email for a user so that they cannot enable it

Weird, indeed.

You can suppress the email address at the SES level: