why not give the "nologin" user ksh as the login shell and put code in $HOME/.profile to check for whether $LOGNAME correspond to the "who am i" output? if yes, exit out ... if no, proceed ... (change $LOGNAME and "who am i" as appropriate for your OS) ...
Code:
ME=$(who am i | awk '{print $1}')
if [ "$LOGNAME" = "$ME" ]
then
echo "Login not allowed"
exit
fi
