Move Users is part of Privileged Task Automation.
You can trigger moving users to a disabled OU by setting the AC_NewParent attribute in the provisioning plan. You can trigger this through creating a Disable Provisioning policy as Phil does in the following:
or by using a before provisioning rule as described:
There is a Service Standard Before Provisioning Rule that you can request in your tenant that you only need to configure. You will just need to ask for it to be deployed in your tenant.