Beware that setting a user's login shell to
/sbin/nologin which has the very minor benefit of displaying a custom message) breaks
su to that user. Some system scripts may be using
Setting a user's shell to a program that does nothing is a security benefit, but only if the user would otherwise be able to log in due to a misconfiguration. A system user should have no way to authenticate, in which case the shell setting does not matter. So it's a good idea, but only if it doesn't break anything.
You can disable SSH access for some users in another way: by adding a
DenyUsers directive in
/etc/sshd_config. This will prevent those users from logging in over SSH, but won't prevent logging in through another service if that service is misconfigured.
Another way to block login to an account is through PAM. The advantage of this method is that you can have different settings for each service, e.g. allow
su (which will only work for root if the account has no password) and disable anything else. You can use the
pam_access module to deny certain users.