Assuming you only want to su user from root's account, and disable all other access:
Use this (run as root):
usermod -e 1 -L user
This disables password login (as many other answers have advised), but it also expires the account. You can't login to an expired account, e.g. with SSH keys. You can still su user, although it will display a notice that the account has expired.
