You can monitor number of failed Community login attempts on an external user’s account. When max number of attempts is reached, the account is locked.