Wait, you want to allow admins to create users, but not allow users to self-register, right?

Yeah, a paramter on acs-authentication seems okay.