1. Remove any association between the Salesforce profile of technicians and ServiceMax group profile. If this is done, technicians will see the error message 'Your Salesforce Profile is not associated with any active ServiceMax Group Profile. Please contact your ServiceMax administrator to resolve this.' and will not be able to use any mobile app.
Note that with this approach, any ServiceMax online app functionality configurable through group configuration settings will default to the global default (i.e. value set for the settings for the active org-wide profile) for all the technicians.
2. Edit the OAuth policies of the connected apps for each mobile app, set Permitted Users to 'Admin approved users are pre-authorized', then click Manage Profiles for the connected app, and associate only the Salesforce profiles of the technicians who are to be allowed to use the mobile app. You can do this from Salesforce Setup Admin page Manage Apps > Connected Apps. By default, the connected apps for all the ServiceMax apps are set to 'All users may self-authorize'.
With this approach, when technicians login to mobile apps, they will see this error message: 'user is not admin approved to access this app'. Note that this has to done for the connected app for each mobile app - MFL (name of connected app: ServiceMax), iPad app (name of connected app: ServiceMax Mobile), and so on.