It does not seem to be possible to deny registration.
The configuration variables in security.txt do not seem
to work and there is no example in config.py.

Strangely enough I also get other errors with that
registration.
Namely: 

 Traceback (most recent call last):
  File
"/spare/roundup/0.5.0/lib/python2.1/site-packages/roundup/cgi/client.py",
line 405, in handle_action
    getattr(self, method)()
  File
"/spare/roundup/0.5.0/lib/python2.1/site-packages/roundup/cgi/client.py",
line 607, in registerAction
    if self.session:
AttributeError: Client instance has no attribute 'session'