By default, if someone signs up with an email address on your company's domain, they can land in your account and wait for an admin to approve them. You can switch this off so that only people you invite can join.
How to turn it on
Go to Settings → Company.
Find the security setting for same-domain sign-ups.
Switch it on using the toggle button.
What changes when it's on
Only people who have been invited can join your account.
People who sign up with your domain are no longer added as "pending approval".
Good to know
This is a security setting, so only account admins can turn it on or off.
It doesn't affect SSO — people signing in through SSO are handled separately.