This inability to moderate or approve members is an endlessly frustrating aspect of Member Areas, and really defeats the entire purpose. At this point, I've tried multiple solutions for various clients:
The MemberSpace workaround (avoiding Member Areas entirely and protecting content via MemberSpace, along with the separate subscription): this is okay as far as it goes, but it requires a fair amount of additional setup and adds an additional cost (minimum is $29/month). I'd say it's worth it for membership management absent a fully-fledged CRM or something like that, but the bite they take out credit card transactions is also substantial.
The password protected "join" option (user fills out form > human admin sends email with URL and password to password-protected Join page > they join a free Member Area): this is super clunky and inherently not that secure. It's also expensive ($108/year minimum) and is inherently geared toward a transactional, commerce-based relationship which is almost never what my clients want to use this for.
The good old-fashioned password protected page (does what it says on the tin): fine as far as it goes, but there's no way to maintain security or keep folks from sharing the password; if you change the password you have to update all your "users" and invariably this adds either a lot of administrative headache (people lose the password, can't access things, etc) or detracts substantially from any ability to secure data or access.
My verdict is that these are all pretty bad solutions, especially if - as is often the case - you're trying to add something like a private directory via Community Box or other user-modifiable information. I really hope Squarespace gets it together on this front and realizes that a "Member Area" is inherently about community, and as such, requires the ability to set, maintain, and enforce community guidelines, standards, and access.