Hi Kevin,
You may have already considered this, but you could set up a new Role which does not have access to anything - no modules, lists, or actions. During the time that you want to lock people out, you switch them all to that role (that will preserve the settings of their regular role, and also preserve their selective access settings). Then at the end of that period, you just have to replace the original role to them, and all associated rights will come with it. It does require changing the role and then changing it back, but assuming you need to do this on a user by user basis anyway, and that some users will need to retain access during the period. This way of doing it will allow you to select which users you need to change, and it can be done via a simple import in both cases.
If you didn't want ANYONE to be able to change the model, you could lock it, which is done in Manage models.
