Block users from backend

They don't need anything on the backend. What's the best option to keep them off?