Selective lockout of users for specific functions for specific time periods

Hello all

we have a problem in that our HR users persist in changing data after the payroll has closed for input.  This makes it very difficult for us to balance our payrolls.  We would like functionality that can disable the update access (ie give them view only) for the remainder of the payroll period, while allowing full access (view and update) for any future payroll periods.

So if it is 15th June and the payroll is closed, we will lockout any user without payroll responsibilities for the remainder of June.  But they will still have full access to capture data for the July, August, etc payroll periods.