This message was deleted.

I would create a role with limited permissions and then assign the customer that role when paused with whatever logic

That's a great idea, thanks!