If all the users are connected to a seprate network simply physically disconnect them.
If not, you could disallow thier group to log onto the domain through GPO, then reboot the server without notice. Both of these methods means possible data loss though, and probably a bad idea.
The best solution would be to make users aware by creating a login message warning them of the scheduled TIME and date of the maintenence in advanced. Send out netsend messages every 5 minutes to every workstation 30 minutes prior to kicking them off. It would be then ok I guess to kick them, since they should know. If you use the shutdown command as explained, they will have a notice and countdown to save anywork they are doing. But of course if they are not looking at the time they still lose work. They can then reboot and use thier computers, but not the domain.
All of this can be done with simple batch files and the scheduling agent. Cept maybe the GPO part.