You essentially override the sign in api on the backend and check that the input email is the one you want to allow to sign in, else throw an error

And you can disable the sign up API by making it undefined.