Hey Thomas,

Unfraternally it is not possible to stop creating the user/member when you use the autolinking.

The only solution as I see it, is give the users a role to those that allowed to create a user, and on OnExternalLogin see if the current identity have in the Claim the allowed Role, just to prevent the identity to login in something like:

OnExternalLogin = (user, loginInfo) =>
            {
                bool allowed = false;
                var claims = loginInfo.Principal.Claims.Where(x => x.Type == ClaimTypes.Role);
                if (claims.Any())
                {
                    foreach (var claim in claims)
                    {
                        if (claim.Value.Equals("adminAccess", StringComparison.InvariantCultureIgnoreCase))
                        {
                            allowed = true;
                            break;
                        }
                    }
                }

                user.LockoutEnabled = !allowed;
                user.IsApproved = allowed;

                return true;
            }