Create process to cancel IT Shop requests for specific service items/roles

What I would do:

1. Create a separate shop for these system roles and define as customers of this shop just the Persons (Identities) with IsExternal=1
2. Remove the system roles from the standard shop

In that case, the requests will be ended if the persons are no longer customers of the special shop.

Thanks, this would indeed work. 

Is this the best practice? I'm thinking in the long run if there will be many different scenarions and attribute data from where a user should unsubscribe from certain roles, that would be many different shops.

It is the best practice for the initial use case you described.

Thanks!

Thanks!