You are correct. As well as unchecking alerts in the settings.

It seems that the solution to having a username/password is to make everything run from links via those emails, after they've confirmed. This may be worth exploring.