Restricted Google Play Service hangs up the booting process
This is a known issue when blocking Google Play Services using Privacy Guard on CM13. However there is a workaround if the device has a custom recovery like TWRP installed.


Boot into recovery
Open File Manager
Navigate to /data/system
Delete the file named appops.xml
Reboot.


Since you've not rooted/installed custom firmware, the only option is a factory reset from recovery. You'll lose all apps, but data stored on the device storage will be safe.