I see a very well documented way, if a user is not enabled to decrypt the boot volume, to enable that user: just go into the FileVault control panel, and if there are users not permitted to boot the system, there will be a message so-indicating, and a button that will bring up a dialog for enabling them.
I have the converse problem: I have a user FileVault-enabled user, who should NOT be.
Is there a way to do this?