disable ssh/login for individual an account?

["patrick denton" <patrick.denton@dataops.net>]

I'm using an account called (renamed to protect the innocent) "fwadmin"
which only has permissions by way of sudo to vi /etc/ipf.rules, vi
/etc/ipnat and execute ipf, ipnat, ipmon and ipfstat.   I would like to
make it so that you CANNOT ssh into this account remotely but you CAN su
to it once your logged on as yourself.  I was wondering if anyone would
have a particular favorite method for this.  I'm not even sure if this
is more of an OpenSSH question either so be gentle with the flame
throwers.  Thanks in advance.