This may be of interest:
-i, --inactive INACTIVE
This option is used to disable an account after the password has
been expired for a number of days. After a user account has had an
expired password for INACTIVE days, the user may no longer sign on
to the account.
If you force a change of password by expiring it and set a inactive date of 4, if they do not login within 4 days... it's disabled.
This is in the man pages of passwd