users must have the permission to create a MySite. You can remove this
permission - by default members have it , readers do not. If you do not want to
remove it from the members role, you can create a second role like Members
(MembersNoMySite) and give them the same permissions with the exception of
creating the personal site and add those groups/individual that you do not want
to allow personal sites to this new group.