I don’t know if you can do that without a plugin (but I might not know). If you’re self-hosted and don’t mind adding a custom plugin, it shouldn’t be but a couple hours of time (for someone who regularly writes such plugins) to reject the users you don’t want.
One solution would be to allow them to log in but put everything in categories accessible only to groups that are defined by those roles. It should be easy enough to find info on how to have those roles define groups in Discourse (but I’ve not done it).