Dave

Allow new users to register but not log in until authorised

We have a Laravel system at work where it is only supposed to be used by staff, but they can use it...

Yes, that does sound like the best way to go - the admin already has to take action for each new use...