I've also lost quite some time kicking accounts and repositories,
in the end I've combined some of the options below (don't forget the [service]
section marker and also restart after the changes !)
[service]
DISABLE_REGISTRATION = True
REGISTER_MANUAL_CONFIRM = True
EMAIL_DOMAIN_ALLOWLIST = XX_your_domain_here_XX,cloudron.local
DEFAULT_USER_IS_RESTRICTED = True
It's overkill if all are used at the same time, but depending on the needs and paranoia, it can be useful