The PAM config file for login should have the nologin module at the top of the authentication stack with control flag "requisite." The contents of the nologin file will be displayed in any case (with the default configs), so moving the module to the top of the stack in no way increases security exposure. Putting that module at the top and making it requisite, however, does reduce the nuisance value of being prompted for a password when access will in any case assuredly be denied. It furthermore is a minor security gain in the case of a network login (e.g. telnet) because no password will ever be sent across the network in the case that, because of the nologin module, there is no chance that access will be granted.
This is a small win, and nobody else has asked for it. I think this is really policy that's site-dependent.