The easiest way to disable the crontab for a specific user is to locate her crontab and rename it. The Debian man page for cron says:
cron searches its spool area (/var/spool/cron/crontabs) for crontab
files (which are named after accounts in /etc/passwd); crontabs found
are loaded into memory.
So just rename the file to something that is not in the passwd, usually by giving it a suffix like
dead or similar.
mv -vi /var/spool/cron/crontabs/user2 /var/spool/cron/crontabs/user2.disabled
On Debian (and related systems like Ubuntu) this produces the following entry in
(user2.disabled) ORPHAN (no passwd entry)
Make sure to also add
user2 to the file
/etc/cron.deny, otherwise the user will be able to create a new crontab for herself.
Re-enable the user's crontab by deleting the entry from
/etc/cron.deny and renaming her crontab:
mv -vi /var/spool/cron/crontabs/user2.disabled /var/spool/cron/crontabs/user2