On Indy 9, there was an event for refusing a connection before it was actually accepted. On Indy 10, it's still not implemented.
If you look at IdCustomTCPServer.pas, in procedure TIdListenerThread.Run
there is a comment in there about exposing an event to the user to let them decide whether the connection should be accepted.
I would modify the source and implement it there.
If that's not for you, then you can disconnect them in the OnConnect event.