I am quite new to this myself and came across the exact same issue recently. With still not being 100% sure as I didn't get to try it myself I came across Blocking Functions.

It is under Authentication -> Settings -> Blocking Functions, which seems to give more power to the admin with regards to user authentication

You can find more information in through this link