You (both) need to set the users’ shell to something like /disabled or /bin/false or similar and use the nginx configuration disabled_shell to the shell you set. We’ll recognize that the users’ shell is the disabled shell and won’t boot the PUN.
/disabled
/bin/false
disabled_shell
Here’s a similar topic.