You can prevent specific user accounts from obtaining use licenses by adding users' rights account certificates to the user ...

You can prevent specific user accounts from obtaining use licenses by adding users' rights account certificates to the user exclusion list.

The following is the specified user name or the public key string of the rights account certificate to be excluded on this AD RMS cluster.