Kinda new territory for me this but maybe you can use the shun command to lock out a user:
To enable a dynamic response to an attacking host by preventing new connections and disallowing packets from any existing connection, use the shun command in privileged EXEC mode. To disable a shun that is based on the src_ip, the actual address that is used by the security appliance for shun lookups, use the no form of this command.
shun src_ip [dst_ip src_port dest_port [protocol]] [vlan vlan_id]