Yeah, you can turn off registration without a token. Then, if you want someone to register you can issue them a registration token, or manually create their account.

Federation can be turned on, on a case by case basis.

You can set rooms to invite only and not discoverable. Alternately, you can use an invite-only space that allows users to join rooms from there.

The first two parts are done in the server config, see the synapse docs. The last is done once the server is setup and running as an admin.