Hey Nico,
Haven’t tested this in a while but most likely the behavior has remained the same (confirmed status doesn’t influence permissions)
The field “blocked” though does block user requests if set to true
The solution I found to my problem was setting the default role after registration to be “public”, meaning that registered users don’t automatically become authorized
If they do need different permissions from regular “public” users one can reproduce this solution by making a “pending” role and setting that as the default after registration
Hope You found this helpful