The advice I've always heard on this is to set their shell to /bin/false. I don't know how well this works, but I assume they'd get a login screen and then immediately exit. If anybody has a better approach, speak up!