Changing user’s role to “No Role for This Site”

The best way to disable is to delete the user from the site. I suppose you could change their password and email without deleting the user, making it difficult to login or reset their password. Their current auth cookie will remain functional though, until it times out. You could reset the security salts to disable their auth cookie, but that would force all users to log in again.

If you simply assign a role with no capability, they can log in but cannot do anything else. If you want to display a message to such users on any given request, use an action like “init” to spot such users and when found, call wp_die() with your preferred message.

What ever you do, if you have open registration, they could easily register as a new user to get around any measures against them that you’ve implemented.