Completely lock user account on server, including ssh

I need to lock some user accounts, without messing with their HOME, if at all possible. Normal way would be usermod -L user but it seems to leave open ssh login with public key authentication (routinely used on this server). I know I could just mv /home/user/.ssh /home/user/_ssh or something similar, but is that the right way of doing this? What am I missing?