Is there a way to do one or both of these two things?

1. Delete enrollment data for a particular user, even if the account is active.

2. Restrict users based on group membership instead of OU, Disabled, etc.

We have a need where we block access to an account by changing their password. If they are enrolled, they could simply reset it!