Currently you can only deploy with public account creation available. However, we should expose an option to lock this down.
To lock it down requires changing the ACCOUNT_ADAPTER here https://github.com/dimagi/commcare-sync-ansible/blob/master/roles/commcare_sync/templates/django/local.py.j2#L15-L16
It should be set to EmailAsUsernameAdapter if public account creation is enabled, or NoNewUsersAccountAdapter if it is not.