use $g_allow_signup = OFF to disable signup link and $g_send_reset_password = OFF to disable sending reset password. (If an administrator clicks the reset link on send_reset_password is off, the password is set to blank.

The problem is that I don't want the new user e-mail to go out either since we are using ldap.

I commented out line 390 in core/user_api.php:
email_signup( $t_user_id, $p_password, $t_confirm_hash );

There should be an option to disable this in future version.