I put as little as possible in my controllers.

The way to think about it, is "what if I needed this elsewhere?" or "what if I need to unit test this?"

That way, pretty much everything except the basic logic for "if this, then that" goes into a helper, library, model, repository, etc. You can then group all this kind of functionality in one class, rather than shoehorning it all into a controller.

Controllers really should only be making top-level choices about the current route. Everything else should as much as possible be farmed out to other classes.

Obviously, I don't know your app, but from the looks of things, most of the stuff there IMHO should be in an Auth (or something) helper class.

Again, not that I understand your code, but if it was my controller, I would be aiming for something like:

public function blockUser(Auth $auth, $userId)
{
    return $auth->isUserBlocked($userId) 
        ? $auth->getBlockData() 
        : $auth->somethingElse();
}