Banning terminated users from VPN

[Sam2]

ENV - R80.10 JHF 288 

Our current process for removing remote users who have been terminated is to run "listusers" on the firewall and grep the username and create a 24 hour long sam rule banning their public IP. Most of our users are not IT savvy, and this is more than enough to keep them offline while their certificates are revoked. 

I would like to move to using an access role that I can automate using the API to populate which users go into it, that way I no longer have to manually login to find the public IP and push a SAM rule. 

The issue that I am having is that the access role will block everything but their DNS requests coming inbound on an implied rule, I am assuming this is because I have those DNS servers added in the office mode configuration, does anyone have a sneaky solution around this? 

Thanks

[PhoneBoy]

Generally DNS is allowed on an implied rule.
Believe this is set in Global Properties, what is it set to in your case?
It could also be the implied rule is buried in .def files somewhere.