Create an Exception annotated with @ResponseStatus e.g. like this:
@ResponseStatus(HttpStatus.FORBIDDEN)
public class ForbiddenException extends RuntimeException {
}
Now just throw that Exception in your handler method and the response will have status 403.