My company › sub-companies › manage, at the bottom. Each person is a named seat. Company admin.
Open My company › sub-companies › manage. Type their work email and press invite. The row appears under users. The status is active. Disable is on that row. Under the list, with no mail provider, the console shows a one-time link and a temporary password. Those are shown once and are not in this picture. Hand one of them over, then it cannot be shown again. They have no API key.
The label turns into confirm: disable. Press it again and that person is signed out. The next sign-in is refused until you press enable on the same row. Acme stays, and anyone else you invited can still sign in. This shot stops before the second press, so Sam can still sign in.
The whole login, every person, is Disable a customer's login. Someone in your own company is Disable a person's sign-in. Inviting the first person is Let a customer manage their computers.