How to restrict access to /user page?
Since user is already defined as menu item from a module, you cannot use hook_menu() to alter it, but you need to use hook_menu_alter(). Since user is used for the currently logged-in user, it probably a bad idea to redirect them to login.

As said from Mołot in his comment, the correct way of altering the login process is altering the login form, and add new validation handlers. This is similarly to what the OpenID module in Drupal core does.

function openid_form_user_login_alter(&amp;$form, &amp;$form_state) {
  _openid_user_login_form_alter($form, $form_state);
}

function openid_form_user_login_block_alter(&amp;$form, &amp;$form_state) {
  _openid_user_login_form_alter($form, $form_state);
}

function _openid_user_login_form_alter(&amp;$form, &amp;$form_state) {
  $form ['#attached']['css'][] = drupal_get_path('module', 'openid') . '/openid.css';
  $form ['#attached']['js'][] = drupal_get_path('module', 'openid') . '/openid.js';
  $form ['#attached']['library'][] = array('system', 'jquery.cookie');
  if (!empty($form_state ['input']['openid_identifier'])) {
    $form ['name']['#required'] = FALSE;
    $form ['pass']['#required'] = FALSE;
    unset($form ['#submit']);
    $form ['#validate'] = array('openid_login_validate');
  }

  $items = array();
  $items [] = array(
    'data' =&gt; l(t('Log in using OpenID'), '#openid-login', array('external' =&gt; TRUE)),
    'class' =&gt; array('openid-link'),
  );
  $items [] = array(
    'data' =&gt; l(t('Cancel OpenID login'), '#', array('external' =&gt; TRUE)),
    'class' =&gt; array('user-link'),
  );

  $form ['openid_links'] = array(
    '#theme' =&gt; 'item_list',
    '#items' =&gt; $items,
    '#attributes' =&gt; array('class' =&gt; array('openid-links')),
    '#weight' =&gt; 1,
  );

  $form ['links']['#weight'] = 2;

  $form ['openid_identifier'] = array(
    '#type' =&gt; 'textfield',
    '#title' =&gt; t('Log in using OpenID'),
    '#size' =&gt; $form ['name']['#size'],
    '#maxlength' =&gt; 255,
    '#weight' =&gt; -1,
    '#description' =&gt; l(t('What is OpenID?'), 'http://openid.net/', array('external' =&gt; TRUE)),
  );
  $form ['openid.return_to'] = array('#type' =&gt; 'hidden', '#value' =&gt; url('openid/authenticate', array('absolute' =&gt; TRUE, 'query' =&gt; user_login_destination())));
}