In reply to mark k..

Even simpler change their role to subscriber which by default doesn't let you do anything extra but view private pages as far as I know.