The only way I've been able to achieve this is to stop the TPS's that the users use (also remember to do any Service Portal / Webdesk ones).
If the TPS is down, the customer can not get to the database.
I have a dedicated TPS that is used only for admistration purposes.
Another suggestion - assuming you have a typical configuration I'd do a net stop w3svc on the main web server and do all your admin work on the apps server. Once done, net start w3svc on the web server and away you go.