(there is a field on the Contact "Login Enabled" all you need to do is set it to No.)
And a new date field to the Contact record e.g. Portal Access Expiry
Set its value to a week in the future
Create a Flow on a timer trigger
Query all Contacts where the Portal Expiry is on or before today and Login Enabled == true
Loop the results
Set Login Enabled = false
Note: Removing Web Roles does not stop the user logging in, but can stop them doing anything once logged in. Also, if you are making use of a Web Role that is set to Authenticated Users removing Web Roles will not stop the Users inheriting off that inherited Web Role - Setting Login Enabled to false will stop them logging in.