Actually, what I did was change their password, then go to https://yourinstance.my.workfront.com/login and login as the user since I have that password. Then log off. That works if you don't force the user to use SSO. I'm not sure how you are turning off SSO but if it's system wide, maybe it's easie...