If the mac has a local account, by definition it isn't using your domain services, so unfortunately yes you would need to lock the machine or use code: "pwpolicy -u $username disableuser"

@dsavageED,

the mac is in our remote management so there should be no local account. Is there another solution then?

In more detail;

If the Mac is still checking in with jamf then you can create a policy to run the command I mentioned above, you can even force a logout.

Create a new policy - give it a name like lock login session, set trigger to Recurring Check-in, Frequency Once per computer

Files and Processes

Execute Command - "pwpolicy -u $username disableuser; killall loginwindow" where $username is the login of the user you want to disable.

Scope this policy to the Mac

Or more simply lock the Mac with the MDM command...