If I freeze a user and if he is already logged into Salesforce, does he lose access? Or can he access it as long as he doesn't logout?
Based on a quick test in my DE Org, if an admin Freezes a User while the User is already logged in and accessing Salesforce, the User session is immediately terminated. The User cannot navigate to any other page/tab within the application once Frozen. The User is presented with a message as below.
Incorporating @sfdcfox's comment: The behavior is same if a User is deactivated.
Salesforce checks the session's validity with every transaction. This means that if the user tries to continue working outside their Login Hours, while Frozen or deactivated, or if the IP address changes and "Lock session to IP address" changes, they will not be able to access Salesforce. There's no way to continue using a session if you're not allowed in the system for any security policy.