If you don't want people to log on a box in anyway, don't have the account. I don't see what's so strange or complex about that.

/bin/false has never been security. It's just good behavior for users that aren't supposed to get a shell. And that's that, they dont get a shell. They get everything else. Generally, those are daemons !