Thanks for all the tips.
We do thought about it but we have a privacy and security product which means we do need to protect our users as much as possible. The content is public for sure but not the IP Address/Agent/Referrer/Email if I understood Discourse Akismet correctly, it is transmitted to Akismet (sure would also read the privacy policy but the overview is already enough information for the decision).
That would be an idea. With ~2 signups per day it shouldn’t be too much trouble, but it’s not the best experience to wait for an approval, but if we explain it properly it might be the best option we have for now.