You can use your sso to suspend them with whatever means it provides. Discourse will never know and there will be no repercussions.
You could move them to a discourse group that has no privileges (but that’s likely not easy, depending on your setup).