You might be able to control this via your SSO identity provider, to mark that client’s account so it is not auto-authorized.
Adding: suspending as Jay mentioned will prevent them from logging in and interacting with the site, but I would be concerned it does not meet the criteria the client is asking, which may not want their user information showing up anywhere in the Discourse site. 