How about: 'Staff must approve all new user accounts before new users are allowed to login.’? I do think the ‘… before they are allowed to access the site’ part is misleading, especially if you come across this setting without knowing about the other related options outlined on Configure Discourse for a closed or private community - the ‘login required’ setting in particular.