Is there a way to disable SFTP access without changing the user password?

Is there a way to disable SFTP access without changing the user password?

We have a web app that allows our users to set up vendor SFTP accounts. We
want our users to be able to manage the vendor accounts that can access
their server in a reversible fashion, ie, without changing the password.
Would handing it via group membership be the best way to do it?
Users are currently chrooted and jailed to their home directory on login.
The machine is running Debian Squeeze (6.0.4) and OpenSSH_5.5p1