By default it appears that anyone with valid credentials can sign
themselves up for GMS via the external URL. I haven't been able to find any
way to control/limit this.

What am I missing?