This week brings two new security settings. It's now possible to restrict all sign-ups to your team to a specific domain name through "Allowed domains". This setting applies in addition to SSO and will disallow users from creating accounts that do not have a confirmed matching email domain.
We also added the ability to restrict sign-ups through SSO completely, so that users must first be invited by an admin. Both of these new settings can be found under Settings -> Security.