Security rules enables stuff, they don't disable. So you can't create an overriding rule that blocks users while that rule is active, but if you already have a setup where security rules defines what users are let in you could possibly achieve what you want. Be careful so you don't lock yourselves out.
Another way could be to alter the virtual proxy that is used for logging in. Create a new vp first that admins can use (and be sure to test that it works), and then alter the vp that is normally used so that it isn't functional anymore (e.g. by removing the proxy association).
You could possibly also use the License management. Let's say all users are automatically granted analyzer capacity access through licensing rules. Then you can disable that rule so that only users with dedicated licenses gets access.
Yet another way is that it could possibly work to disable the default security rule "Stream" so that users don't see any streams. I'm thinking RootAdmin may see the streams anyways, but I'm not sure.
