One thing to add: You'll also have to have your script handle changing the password to re-enable an account, probably by keeping track of what the old hash was. Then what you'll do is set users' shells to a special script designed to allow them to change their password.
Of course, I may be complicating this... there may be a way to do this without going to all this trouble, I just don't know it.