Recently, someone with nothing better to do but to be nasty, has taken to creating bogus registrations. It used to be a much more sever problem, but cb antispam added worked wonders.

Unfortunately if they are registering manually there isn't anything CB AntiSpam can do about them unless there's a common thing about their registrations that you can block (e.g. ip address, email address, or email domain).

Now I get about 5-10 a month. I have made the registration link (next to login) not visible, but somehow they still find their way to the registration area. (We are a small group -so if someone needs to register I just turn it on) Is there a way to disable the registration but leave login working?

Yes, set "Allow User Registration" to "Same as CMS "allow registration"" then within Users > Manage > Options > User Options set "Allow User Registration" to "No". This will disable registration completely.

Is there some way I can make the capcha work with only a special code? Then I can make a link such as "If you want to register email me first"? (with the password)

CB Invites can be used to allow people to register on your site by invite only. This is done by configuring the invite_code field to display on registration and be required. You wouldn't even need captcha at that point since they won't be able to register unless you email them the invite.