Best approach to deactivate all users of a Fusion application or block their access?

Please advise on the best approach to deactivate all users of a Fusion application or block their access. We wish to do this after a Non-Production environment is refreshed so we can be sure that only authorised users (who we will reactivate) can use the system.

I have deactivated many users at once at OCI Console level, but this does not seem to feed through to the Fusion application (the accounts remain active). The 'Reset all passwords' option in OCI also does not seem to have an effect... no reset emails are triggered and existing user passwords remain valid.