If you only have a couple users you need to block, I would recommend a MAC firewall rule in the User Profile of the SSID that denies traffic from a specific MAC address. If you have more than a few users we need to block, I would recommend doing this through a firewall or content filter rather than the APs.
You can also set up QoS within the User Profile of an SSID, to limit the amount of data any users in this SSID can pass at any given time. This won't block the user outright, but would keep them from overloading your network when connected.
