Unfortunately not really with what's built in.
You can offer the upgrade, but, the user has to accept it.
If you offer the upgrade, the BlockVersionBelow parameter in 12.9.0+ doesn't apply, but I suppose you could use group configurations to offer the upgrade with a warning, and then remove it.
Premise IM&P has a mechanism to similarly block authentication, but this has mixed results with fast sign in.
Version management is a bit of a pain for sure.