We have come up with a procedure that accomplishes this to some extent.
Create an AP group called "DisabledAP" or something similar. Configure it with the following settings:
rf dot11a-radio-profile "A_disabled"
no radio-enable
!
rf dot11g-radio-profile "G_disabled"
no radio-enable
!
ap wired-port-profile "Locked"
shutdown
!
ap-group "DisabledAP"
dot11a-radio-profile "A_disabled"
dot11g-radio-profile "G_disabled"
enet1-port-profile "Locked"
Then from the RAP Provisioning page, put the RAP in that group. The next time the AP comes online, it will receive a new configuration which disables the ethernet1 port and both radios.
Does that accomplish your goal?