Problem. Some people are still registering and some get auto approved even though options are turned off.

I don't understand. That makes perfect sense. Turning off Approval and/or Confirmation means they don't need to be approved or confirmed. You need to turn them on if you want Admin Approval or Email Confirmation.

I see, please download and install CB Core Redirect found in the Free downloads section. This plugins works at the router level and forces all Joomla users URLs to CB relevant links making it impossible to reach Joomla registration. If this doesn't stop it then they're likely registering through some sort of 3rd party registration page. They shouldn't be able to reach Joomla registration if you have CBSubs Bot installed and enabled though as it already forces to CB registration instead of Joomlas, but if it's not installed and enabled then explains why this could happen. Please PM backend super administrator login credentials if issue persists after using CBSubs Bot or CB Core Redirect.

Made some discoveries. Seems like if a spammer or real person tries to join the site and gets to the pay part and does not pay it still creates a membership with public access.

Correct, this is normal. A user must be registered before they can use CBSubs. If they don't pay then their registration process stops there. They should be unapproved, unconfirmed, or blocked though depending on if your site allows free registrations or if it has email confirmation and/or admin approval.

Is there a way for the info not to be stored unless the person joining pays via cbsubs plan?

No.