How to avoid unwanted user registrations?

In order to implement a subscription model, we have to enable user registration in general settings.

Now we encounter unwanted registrations from doubtful sources which are using wp-login.php?action=register. Adding reCAPTCHA (v2) to wp-login.php didn’t help.

As we’ve implemented a custom registration form for the subscription, we disabled registration via wp-login.php?action=register via hook:

add_action('login_form_register', 'my_subscription_plugin_forbid_login');
function my_subscription_plugin_forbid_login() {
  echo "User registration forbidden.";
  http_response_code(403);
  die();
}

Is this sufficient to avoid unwanted registrations or is there a better way to achieve this goal?