It seems like they need to work on their termination processes to do everything in backoffice systems all at once. As a quick fix, they could edit the permissions DB. A better fix would be to have separate internal and external users in different tables and a different login system to prevent access commingling, and termination would be much easier. Then, it wouldn't affect the public-side. If they wanted to, add an employee decoration boolean to their public user which wouldn't cause security problems.