Moderation of new users?

I have a gitea 1.15.3 instance that I will pay attention to in short bursts as projects require, but otherwise I do not wish it to become a repository for random data uploaded from the Internet without my knowledge. What I would like is for new users to be locked down pending some sort of admin moderation to “unlock” them.

To that end, I put the following in its [service] section:

REGISTER_EMAIL_CONFIRM            = false
ENABLE_NOTIFY_MAIL                = false
DISABLE_REGISTRATION              = false
ENABLE_CAPTCHA                    = false
REQUIRE_SIGNIN_VIEW               = false
NO_REPLY_ADDRESS                  =

I was led to understand that REGISTER_MANUAL_CONFIRM might be what I was looking for, and that it was incompatible with REGISTER_EMAIL_CONFIRM. However, it seems that account creation is completed via e-mail, and the created accounts are automatically marked as “Activated” in the User Admin tab without my taking any administrative action.

I could just disable account creation, but I do like contributors signing up when I already know them. I don’t just want a brick wall: I want some control.

I suspect that I may be misunderstanding the very short descriptions of these configuration settings in the documentation. Is there a better way to accomplish what I am trying to do?

I have had this confirmed as a possible bug in an issue filed against gitea on github, complete with a potential offending line of code. This may not be a misconfiguration on my end.