Dynamically isolate suspicious users and devices