user groups
 

How do you create a user group that as a group property has passwords but can't login?

Logins are handled on a per user basis, not a per group basis. If you want to prevent a user fromlogging in, you can assign them /sbin/nologin as a shell (depending on your config, they may still be able to SSH in).

I've always set my users I didn't want to log in to the shell to /bin/false. I haven't tested it thoroughly, but it seems to keep them out when SSH is used also.