While looking in permissions I was able to only have "Create Profile" and "Create Organization" in Account so basically they cannot do or see anything until after they've created a profile or organization. Same for Unauthenticated and Uncomfirmed.