If you wish to block an account, you are correct in going to the account and editing it. But to block the account you need to check the block box.
Please note that the ‘Blocked’ checkbox is used by Mendix for blocking users for 5 minutes after entering a wrong password 3 times.
See this part of the Mendix documentation:
A user is blocked after three consecutive bad login attempts, regardless of the time between the login attempts. The failed login count is reset after a successful login attempt or when a blocked user is unblocked. Blocking users only occurs when the app security level is set to Production. Users that have been blocked for at least five minutes are unblocked each time the cluster manager runs and, at that point, the failed login count is reset to 0. By default, the cluster manager runs every five minutes. This interval can be changed using Runtime customization to change the ClusterManagerActionInterval setting.
In your case you should set the ‘Active’ checkbox unchecked, to completely inactive the account.