There may come a time when you need to step in and stop one or more accounts from working without deleting them. Depending on your set-up you might do this by removing permission sets or expiring the account.
If you set today's date as the expiry date the account will stop working and you'll have an implied record of when it was disabled. The risk with this method is that if the account is left in this state and the automatic deletion threshold you have chosen comes around, the account will be deleted.
If you use restrictive mode, removing an account's permission sets will remove all access to resources. If you are not using restrictive mode, you will need to use the expiry method above.