How to restrict Smart Card Logon?

We have 5000 smart card users. Of the 5000, there are approx 300 who have a certificate mistake. We need a solution to prevent these users from logon to any of the 5000 workstations. W2K3 AD domain, Vista clients.