What defines a user as disabled is entirely up to you.
Most people seem to use a group called "Validating" (or something), and if someone tries to login that is a member of that group, you get a message to check your mailbox, or request the validation email to be send again.
If you use Simpleauth, the groups are defined in the simpleauth.php config file. If you use Ormauth, there is a users_groups table you should add the new group to. The users table contains a "group_id" foreign key to the users_groups table.