You could use CB Auto Actions and a Redirect action that checks against their registration date on pm_onBeforeDisplayMessageEdit if they just newly registered. Example as follows.

Global
Triggers: pm_onBeforeDisplayMessageEdit
Type: Redirect
Access: Everybody
Conditions
Field: Custom > Value
Custom Value: [cb:parse function="time" time="+24 HOURS"][registerDate][/cb:parse]
Features: Format Functions
Operator: Greater Than
Value: [cb:parse function="time"]now[/cb:parse]
Features: Format Functions
Action
URL: index.php?option=com_comprofiler&view=pluginclass&plugin=pms.mypmspro&action=messages
Message:
That should work. It should redirect them back to the messages page if they've been registered for less than 24 hours. Adjust further as needed. If you need to manually verify accounts though I suggest just using registration approval.

As for captcha you could still consider using reCaptcha Invisible or reCaptcha v3 which typically don't require any input from the user, but should catch bots. The internal captcha mode is also completely accessible with the appropriate aria labels, customization to increase font sizes as needed, and audio. You're going to have a hard time combating spam without some form of captcha. At the very least I recommend having captcha on registration.

Yes I do use reCaptcha on the sign up form. Only 5 big letters. But does the Invisible reCaptcha do the same thing?

Invisible captcha doesn't ask them to fill out anything unless they're suspected to be bots. Then it presents image selection captcha.All re

Site key and secret key. Where do I get these from?

All reCaptcha keys are obtained from Google directly .

Is it possible to hide Invisible captcha on the form?

Yup, within CB AntiSpam > Parameters > Captcha > Modes > reCaptcha > Invisible set "Badge" to "None".