I actually think just disabling login is better.

People that set the shell to /bin/false or nologin are asking for trouble IMHO.

Or even no-X11-forwarding for a specific (command-limited, else there's no point) key.