How to block user on openvpn server without key revocation?

Question

openvpn

Greetings.
The server is on CentOS, the openvpn server is up on it.
Regular situations arise when it is not immediately clear whether the key of the openvpn client is discredited or not. The revocation procedure is quite clear and understandable from the documentation. This is followed by the creation of a new key and reconfiguration of the client computer.
I ask you to suggest a solution on how to block a user without revoking the key (with the possibility of recovery).
Thank you.

Answer 1

If client-config-dir ccd
then
echo 'disable' >/etc/openvpn/ccd/certname

Answer 2

If the user is given a fixed IP, then it can be blocked by a firewall.
It will be able to connect, but there is no way to receive and transmit something through the tunnel.