stop login if user_status equal zero

The user_status field isn’t used by core, so you could use it for your own purposes. Although there may be side effects if WP ever decides to reuse it in the future.

The authenticate filter fires before the user is authenticated. You can hook into that filter and return a WP_Error object to prevent the user from logging in.

function wpse_293904_authenticate( $user, $username, $password ) {
  $user_status = get_custom_user_status_from_username( $username );
  if( ! $user_status ) {
    $error = new WP_Error();
    $error->add( 403, 'Oops. Some error message.' );
    return $error;
  }
  return $user;
}
add_filter( 'authenticate', 'wpse_293904_authenticate', 20, 3 );