Maybe change their shell to something very boring like /bin/true, /bin/date, or cmatrix? Or, more seriously, rbash or scponly. Don't forget to update /etc/shells