Can I stop one device getting on without revoking its certificate?

Yes, suspend it. Open the device or person and press Suspend, top right. Every certificate they have is refused until you press Resume. Nothing is revoked, so there's nothing to reissue or re-enrol afterwards.

Suspend is for a laptop that's gone missing for the afternoon, or a contractor between visits. Revoke is for a device that isn't coming back.

Neither one drops a connection that's already up. Both apply at the device's next authentication, which is within the hour on equipment that re-authenticates hourly. To end the current session, disconnect it as well. See “How do I disconnect a device that is already connected?”.