I think best practice is to disable the accounts in AD.
Then, if you have "Basic Import Constraint" enabled in the NS AD Computer Import, disabled computers will not be imported. In theory, if you have "Directory Synchronization Schedule" turned on they will get deleted at the next sync (weekly by default)