NSM users are essentially mysonicwall.com users. Removing a user from accessing a tenant is done in mysonicwall.com.
NSM users are put into groups, and accessing tenants is via group association. The user can be removed from mysonicwall.com/My Workspace/User Groups/, and remove there. Alternatively, the tenant can be removed from the group, so the user can access other tenants.