How can I have an open registration but approve all registered users first?

You need to make use of the ACL feature, the registernotify setting and the defaultgroup setting.

For example to deny any access to anonymous users, read access to registered users and write permissions to approved users configure your ACLs like this:

*   @ALL    0
*   @user   1
*   @member 4

Newly registered users will be placed in the default group user and a notification will be sent to the admin (configured via registernotify). To approve a user the admin then goes to the usermanager and adds the new user to the member group.

Another possibility is to only change the defaultgroup setting to e.g. a guest group. That will only work on newly registered users, though.

You could also disable the registration and add users only through the usermanager.