User settings - how to have hands-off and controlled self-registration

I maintain a corporate extranet.
We want to grant access immediately (i.e. no admin involvement) only to a defined list of people, who will self-register.
We want undesired self-registrants to be Blocked by default.
So, this module is just what I want. Yet I am stuck on how to configure the User Registration Settings. (admin/user/settings)

"Only site administrators can create new user accounts." -- this blocks self-registration
"Visitors can create accounts and no administrator approval is required." -- this allows undesired self-registrants to be Authenticated users, which lets them in the door
"Visitors can create accounts but administrator approval is required." -- this seems to require admin intervention

Am I missing something?
thanks in advance.

p.s. this is separate from preapproved roles and email verification.