Comment 7 for bug 1712817

As a workaround, you can create a /usr/sbin/policy-rc.d file with these contents:

#!/bin/sh
exit 101

# apt install --reinstall freeradius-ldap
Reading package lists... Done
Building dependency tree
Reading state information... Done
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 0 not upgraded.
Need to get 0 B/24.2 kB of archives.
After this operation, 0 B of additional disk space will be used.
(Reading database ... 28097 files and directories currently installed.)
Preparing to unpack .../freeradius-ldap_2.2.8+dfsg-0.1ubuntu0.1_amd64.deb ...
Unpacking freeradius-ldap (2.2.8+dfsg-0.1ubuntu0.1) over (2.2.8+dfsg-0.1ubuntu0.1) ...
Setting up freeradius-ldap (2.2.8+dfsg-0.1ubuntu0.1) ...
invoke-rc.d: policy-rc.d denied execution of force-reload.

You can also check the package name in that script, and return 101 only for the services you want to prevent from starting, and return 0 for the rest. "$1" is the service name.