That requirement sounds pretty normal.. Just define the grace period / period when the user entry remains disabled in IdM after which the user can be inactivated.
What is your leading identity system? SAP HCM? You could hook up the disabling, SAP deprovisioning and start of the grace period to the "withdrawn" employment status.
I think you're just missing some work on the requirements side and some configuration/testing effort.
regards, Tero
