Whatever you do, don't leave the account in the state left by
passwd -u, with a blank password field: that allows logins without entering a password (except over SSH, because SSH refuses that).
Change the account to have no password, but be unlocked. An account has no password if the password hash in the password database is not the hash of any string. Traditionally, a one-character string such as
! is used for that.
Locked accounts also use a special marker in the password field that cause the string not to be the hash of any string. The marker is system-dependent. On Linux, the
passwd command marks locked passwords by putting a
! at the beginning, and OpenSSH treats the account as locked if the field begins with
!. Other Unix variants tend to use similar but not identical mechanisms, so take care if your password database is shared among a heterogeneous network.
On Linux, you can disable password-based access to an account while allowing SSH access (with some other authentication method, typically a key pair) with
usermod -p '*' username
The user won't be able to change the account back to having a password, because that requires them to enter a valid password.
If you want, you can instead configure SSH to refuse password authentication, regardless of whether the account has a password. You'll still need to arrange for SSH not to consider the account to be locked, so for example on Linux you'll need to remove the
! from the password field (but don't make the field empty — set it to
* as explained above). To disable password authentication for SSH, add a
PasswordAuthentication directive to
/etc/ssh/sshd_config (whichever it is on your system). Use a
Match block to make that directive only apply to a specific user;
Match blocks must appear
Match User username