Make difference between AD users and Local linux users with the same name

Hi,
I configured my system to accept Ad users and it's works.
I would like to block for exemple User Oracle if the password is validate by AD server but not if the validate is from linux server.
The passwords are not the same in the AD server and the /etc/shadow.
The goal is that the linux administrator who choose when can connect on the linux server even if the user name exist on Ad server.
My server runs in 6.9 version.

Do you have an idea ?

Regards,

Vincent