How do I avoid unwanted users create accounts?
It depends on what kind of control over user accounts you want.  By default Drupal allows visitors to register new accounts.  If you want to disable that, you can set Who can register accounts? to Administrators only at /admin/config/people/accounts.