I think we need some similar functionality as you: student user not to be auto-enrolled to courses, but manual by teachers or to have the possibility to self-enroll.
Our settings - maybe useful for you also - are:
- each real user has a moodle user account (we don't use guest or generic "guest" users)
- these users don't belong to any system roles (Site Administration > Users > Permissions > Assign system roles) ... initially we made them "Student", but was wrong because this gave them access to all courses
- to give access: add specific users to "Student" role for the course (Course > Administration> Assign Roles)
- to restrict access: enter an enrollment key for the course (Course > Administration> Settings) and send it to specific users (by e-mail, etc) => offer the possibility for students to self-enroll