We want to be able to temporarily lock out a user by disabling the password and moving the home directory to another place. How can we arrange to reject mail for users in this state?

Change the home directory pointer in the passwd file to something distinctive. For example, we use /home/CANCELLED for cancelled users. Then you can pick up such users with this router, which is placed immediately after system_aliases:

cancelled_users:
  driver = redirect
  check_local_user
  condition = ${if eq {$home}{/home/CANCELLED}{yes}{no}}
  allow_fail
  data = :fail: this account is cancelled