"Unapproved" usernames are still visible to other users

The only guaranteed way would be to use an IdP for your sign-on and manage this there.