Block internet access for one user

[Executer]

Hello,

my firewall is connected via ldap with an active directory domain controller where all users are registered.

My question is if it is possible to create a rule that blocks internet access for only one user ?

Every user can log in on every pc so i can't do it with ip addresses.

Thanks in advance