Sometimes individual accounts (e.g. remote support) should get suspended if not needed.
Introduce the disable node per user account to change the login shell to /bin/false. In addition add a Warning if there are no local user accounts configured at all - better safe then sorry.