Unfortunately I think suspending the users is the only way you can accomplish what you want here. Based on @sam’s description of the user states I think suspending is the way to go. From the linked thread:
So this will accomplish your goal of preventing login and emails, unless you (the admin) explicitly initiate an email.