If these users are part of NT/AD/LDAP--go ahead & remove users from your corrosponding group & update the guoup in the authentication tab, in CE10.
If they are inactive users for a long time & are not getting released & are occupying the locences, just add a switch " -defaultSessionTimeout x " in your web component server. where x is the time on minutes for release those users from the enterprise.
Kind Regards,
JS