Zima automatically configures Mikrotik to prevent the offline IP pool from accessing the Internet. This includes Expired and Blocked users.
It does that by adding a rule in Mikrotik > IP > Firewall > Filter Rules.
If your users are able to access the internet it means someone has disabled this rule by mistake.
Go to IP > Firewall > Filter Rules
Enable the rule again: