Creating some sort of group is the only way to do this. You need to basically filter what users should be given access to Moodle. Then any user that is not in the group will be removed as you specify in the LDAP settings. Moodle needs a way to know which users are meant to be added to Moodle.
FYI - users without an email will just be prompted to add one when they first log in. I actually do this purposely so that users enter their current email when first logging in.