I don't that will restrict ftp, but will restrict telnet or ssh (even better than /dev/null, lots of service accounts have a shell of /bin/false). You need to restrict FTP in another fashion. Check the docs for your ftp server. If you have a lot of mail-only users and few users that are allowed to FTP, you can probably use an allow list instead of a deny list.