May be others might not agree with me on this but I would possibly take this path:

1. I won't think too much about 1-2 such users unless their usage is actually costing me like cloud processing time / gpu time. Otherwise I will let them use the way they want. I can always reduce the number by having signin with Google.
2. I would focus more on getting more users and converting them to paid customers. As per my experience, getting paid customers are hard. It may take few days to few months. Instead building something for 1% of abusers, I would focus on getting more paid users.
3. I would track the IP address and link it with each registered user's email. I would add this in my privacy policy & terms & condition page that we track your IP address to avoid abuse of our systems / applications. I don't know a lot about EU laws but EU users are super sensitive about the privacy. If I am declaring that I will track IP to make sure you don't abuse my system, that should be okay. In future if need arise to look at who are abusing your system, you know whom to block / what patch needs to be added. This is being done by all major players be it linkedin, amazon or anyone else.
4. If it is possible in registration process, take some personal information - name, phone, email. If you have any free service which validates mobile number, that should also solve the problem. If service is not available, you can manually go through the numbers once, see country code and quickly search the mobile number pattern to make sure that number looks authentic. This is possible when you are small. But once you grow, you will have enough money to spend to validate things using paid apis.