Create a regular remote admin list, but remove DIR/public. This allows moderators to (un)subscribe users and have archive access, but rejects all user requests. Posts work as usual. Naturally, this can be combined with message moderation or ezmlm-issub SENDER checks (see Restricting message posting to the list).