Yeah, it's on a 'per-account' basis.
If you want to block an IP from accessing the entire server, just add it to your firewall (or add it manually to your IPtables)
To add it to apf firewall:
apf -d
IP ADDRESS
Or, to add it via IPtables:
iptables -A INPUT -s
IP ADDRESS -j DROP
(replacing
IP ADDRESS with the actual IP)