Just locking the linux account isn’t enough, since the user can use other methods to login, such as PKI.

The best solution would be to force expire the account:

sudo chage -M 0 username