I do not know yet which is the current upstream recommendation for that, but I can tell you what we do then you think if is of use for your case.
For CAS 3 we developed a custom support module (cas-server-support-blahblah) that we link from our edited cas-server-webapp module's deployerConfigContext.xml and use its BlahblahAuthenticationHandler that extends AbstractJdbcUsernamePasswordAuthenticationHandler in which after checking that the credential is correct, we check how many TGTs are assigned currently to the user, and prevent further logins if a limit has been reached.
If we wanted to do what you want, instead of checking the count of TGTs assigned to the user we would invalidate them.
So I think the answer to your question is a yes, assuming that same freedom is available for CAS 4 and 5 too; but it is up to you if it makes sense for your case in terms of your development costs and effort.
Hope that helped.