In Storefront 1.0, deactivating a buyer site was simply matter of navigating to Edit Company Information and unchecking the Active checkbox. This still is the recommended method for 1.0 sites and is preferable to deleting the site.

However, with Storefront 2.0 sites, the Active checkbox doesn't affect the 2.0 site URL. This means that even though you may think you've deactivated a given buyer, you may suddenly receive an order from that site...because your customers can still access it.

Here's the solution: change the "Default 2.0 Site" back to blank. If you cannot do that, simply change the 2.0 URL. For example, add "-Deactivated" after "/store". See screenshot.