You an use the hostapd_cli command to control the hostapd daemon. To force a client off the wifi you can use either the "disassociate" or the "deauthenticate" command.
hostapd_cli deauthenticate 00:5e:3d:38:fe:ab
make sure you have the ctrl_interface properly set in your hostapd config!
The default is this:
ctrl_interface=/var/run/hostapd
It depends on the Client if it will reconnect right away though. This could be "remedied" by filtering his packets using iptables so he doesn't get an IP anymore and thus is highly likely to not try and connect again.
NOTE: Doing the latter with iptables might make the client "blacklist" your AP, at least for a certain time!
NOTE2: If you do not provide a default route with your DHCP-Server you should not need to disconnect them from the wifi at all. Though most devices (Smartphones) will avoid the wifi alltogether since it's not what they expect (an internet connection).