Currently, a new user registering (Legacy Stack => user/register) will be automatically authenticated if there is no validation required.
If validation is required, then the account is deactivated right after its creation which involve it it not logged in.

The worflow required in the current project is: creating active user account upon registration, send them an e-mail with an automatically generated password, keep them unauthenticated until they actively log in with the password they received.

Everything in the above workflow is possible at low cost thanks to custom validation with (in site.ini):

[VerifyUserType_custom]
Class=JobCustomUserValidation

but not avoiding the automatic log in which would involve hacking kernel/user/register.php or redefining kernel/user module/action which isn't easily possible either.

The idea is: activate/deactivate this automatic login through configuration.