You can achieve that by overriding user-permissions Auth functions.
Check the image for clear reference:
Apply your custom code here in callback (login) function and you can give access to the unconfirm users for login.
Just make sure you to add a flag in response to identify in frontend if the user is confirmed or not, by that way you can use Authorization.