Imho the only way would be to delete the session in the database (#__session table).
Then the user is forced to log in again and the permissions are calculated fresh.
UPDATE: As the comment below, there is no "joomla way" to destroy the session if we are using JSessionStorageNone
. So, you likely have to wait till that users session times out or he logs out himself
.