We only lock the credentials and not the user. Here are the steps to enable/disable a credential for an user.
1. Login as Global Admin/Org Admin in CA Administration console 2. Go to search users and administrators link. 3. Search for the user whose credentials need to be enabled or disabled. 4. Click on Manage Authentication credentials link. 5. Enable/Disable the credential user has.