You can set user.inactive = true to prohibit the login for that user. May be useful in case of blocking access temporarily or for the sake of preserving historical records.
