And welcome to LQ!
If you were after something that allows them a login-window, e.g. from
1500-1700 hours you could easily use porttime, which would enforce those
rules. If you really want to be flexible around this I think you'll have
to start scripting, utilising the information from the `last` command, and
run the script every minute via cron, and modify port-time on the fly so
it can then enforce your limitations.