Blocking users from SPO

The license is an obvious route but be careful because I think they will lose access to their ODfB, not sure if that will kick off the deletion process. In our tenancy, all new users are added to at least one AD group that gives them access to all core SharePoint facilities so that is also a good way to apply control without having to mess with licenses. Of course, that really needs some setup before you can make full use of it. Create the AD Security Group, add all licensed users to it (a script), add the group to all appropriate SharePoint objects (Site Collections, sites, etc. depending on how you have security set up).