Or just use an IdM to manage groups externally, and have it subtract them from those groups, rather than push discourse to implement a subtractive permissions model.
Problem is, there’s little to stop them just creating other accounts. Your endeavours above have problem quite comprehensively that this is a people problem, not a technology problem.