We are developing a SaaS product which is composed of several individual applications communicating with the same API. I am currently facing a situation where I have to let users know whenever their access to the application has been denied. More specifically, whenever their company account is blocked, they should be informed, that they no longer can use the application until they pay (or contact support).
What would be the best way to approach it? Consider that the actual access (login) to the application shouldn't be denied. Should the user then be greeted with an overlay explaining the situation? If so, then what if the user inspects the respective code and removes it, hence be able to perform any action anyways? Should a message be shown above everything, while they can still work around the application? Or should we just simply deny logins and expire all existing sessions?
Is there a best practice for situations like this?