By default, registration is enabled and new users can create groups. You can adjust this using the following variables in /app/data/env.sh:
export FEATURES_DISABLE_CREATE_USER=1
# users must be invited
export FEATURES_DISABLE_CREATE_GROUP=1
# users cannot create groups
export FEATURES_DISABLE_PUBLIC_GROUPS=1
# disable /explore
export FEATURES_DISABLE_HELP_LINK=1
# disable the help link
export FEATURES_DISABLE_EMAIL_LOGIN=1
# Disable login via email (usually when you have enabled SSO of some kind)