Personally, I'd suggest a "user invitation system", or just have the admin create the accounts straight out.

The idea of "security in depth" says you shouldn't allow anyone any more access than they absolutely need. If you disable registration, you put up one more barrier between the naughty people and your data.

With registration disabled, you have some options (the below being just some examples):

• Have the admin create the accounts outright
• Have the admin send an 'invitation' to an email (and only allow that email to use it)
• Create single use 'invitation links' that allow a user to register

The most straight forward and secure method is probably to just have the admin create the accounts out right. If you know what the emails will be, that's probably the choice I'd go with.