Hello,
You can use a before provisioning cloud rule for the source which will check for remove entitlement request and also, it will look into respective identity of the user whether it has any roles assigned, if no, you can trigger an Account Disable Request.