Block users from signing into services until the service is enabled for their account

[Jokler]

Is your feature request related to a problem? Please describe.
Currently anyone who gets an account can use all services by default which is not always wanted.

Describe the solution you'd like
There should be some way (like a checkbox) to enable services for a user with the default being disabled. This could be added to the permissions page or as a separate page.

Describe alternatives you've considered
Each service could have a permission that is required for every endpoint but the experience of signing into a service to be greeted by a forbidden screen wouldn't be very good.
hiveId could also have a default permission it assigns to every service and checks against during sign-up but that feels a bit hacky to me.