Thirteen years later ... for anyone finding this post while looking for a way to locally override the shell for a specific LDAP user on a specific host, there's a way you can do it by writing the override to the SSSD cache.
For example, something like
sudo sss_override user-add myuser -s /sbin/nologin
will set the shell locally for
/sbin/nologin (preventing normal logins on that system). Use
user-del to remove the override.
Typically you'll need to restart the daemon after making these changes.
sudo systemctl restart sssd
You'll probably need to install a package to use sss_override, eg.
sssd-tools on RHEL.