Disable user login, register and password reset
in a custom module that we call 'custom', have custom.services.yml with content :

    services:
  custom.route_subscriber:
    class: Drupal\custom\Routing\RouteSubscriber
    tags:
      - { name: event_subscriber }


then create the file src/Routing/RouteSubscriber.php with the following :

&lt;?php

namespace Drupal\custom\Routing;

use Drupal\Core\Routing\RouteSubscriberBase;
use Symfony\Component\Routing\RouteCollection;

/**
 * Listens to the dynamic route events.
 */
class RouteSubscriber extends RouteSubscriberBase {

  /**
   * {@inheritdoc}
   */
  protected function alterRoutes(RouteCollection $collection) {
    // Always deny access to unwanted routes.
    $disallow_routes = [
      'user.login',
      'user.register',
      'user.pass',
    ];
    foreach ($disallow_routes as $disallow_route) {
      if ($route = $collection-&gt;get($disallow_route)) {
        $route-&gt;setRequirement('_access', 'FALSE');
      }
    }
  }

}


enable the 'custom' module and this should work :)