How to deny access to any system user who attempts to log in without password usage?
By default ''@localhost, and other bunch of accounts exist in a freshly installed MySQL instance.

If you execute SELECT user() you may see something like this:

mysql&gt; SELECT user();
+--------------------+
| user()             |
+--------------------+
| user-one@localhost |
+--------------------+
1 row in set (0.00 sec)


That user doesn't really exist, and it is actually mapped for authentication and authorization to:

mysql&gt; SELECT current_user();
+----------------+
| current_user() |
+----------------+
| ''@localhost   |
+----------------+
1 row in set (0.00 sec)


In order to fix this, run the script mysql_secure_installation always after setting up a production database, and it will ask you to set a mysql root password, delete remote access and delete the passwordless default accounts. This should be part of any proper mysql installation process, and it is documented here.

Starting with 5.6 and 5.7, better security defaults are used, but only on official packages.

Remember that by default, all users have write permissions to write on test% databases. That is a very dangerous default, and should be fixed before production.