I havent tried this before,

but have you thought about creating a job that runs each night and changes the permissions for those users to DENY, and then run another job that gives them permission back in the morning.