Since NC 17 there is a “remote wipe” feature Nextcloud 17 brings remote wipe, collaborative text editor and next generation secure watermarking and you probably have to use it to remove content from the users devices when user left.
Changing password will also not affect “Apps Passwords” If I create them, they will remain.
Also if you have company with access controlling to the E-Mails, could be a good idea to use IAM System of them. In this case if user left company - E-Mail account disabled/blocked will automatically drive to user block on NC.