Visitors can create accounts, but they don't become active without administrative approval.
... See full list
define('USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL', 2);