If the user has a local replica, you can use the option "Enforce consistent ACL" in the Advanced Section of the ACL. Once this option is enabled, you can replicate a chane of he ACL to the local replica removing the local user. Since the "Enforce a consistent ACL" is in force, the local user should not be able to modify t e ACL locally. The problem is that you must do this prior to removing the user from the database.