I can imagine two ways:
- a periodically scheduled script that would enable and disable individual accounts or the whole VPN server according to a time schedule. This would prevent the user from establishing the VPN connection at all
- use of the time match condition in firewall rules would allow the user to establish the VPN connection but no data could flow through it. This approach requires no scripting
Depending on what is your actual issue, bandwidth control could be somewhat better than total on/off.