This should be addressed in the registration form, the backend function it calls, and any subsequent login attempts.
<input type="number" ....
In order to create the override, go to System / Templates (site), click on your template and use the tab "Create Overrides", which will also tell you where it is saved.
The fields are defined in the form xml, you may not remove fields, but you can add some using the User Profile plugin. Never edit core files.
It seems there are no plugin events called upon registration, so either you intercept the call with a system plugin, or - way better - you use the override above to redirect the registration to your custom code to ensure nobody bypassed your frontend validation. This is just an extra check, as the part below will ensure it won't work even if the user manages to bypass your authentication checks.
When the user attempts to login, the authentication process goes through the authentication plugins in the backend, so you should create your own authentication plugin (i.e. your manifest should contain:
<extension type="plugin" group="authentication" ...
and just return false along with an error message so the user will know why it's not working:
public function onUserAuthenticate($credentials, $options, &$response)
$response->status = JAuthentication::STATUS_FAILURE;
$response->error_message = JText::_('YOUR_CUSTOM_ERROR_TRANSLATED_STRING');
Of course this is very basic, you might want to add checks so that your admins can continue using alphanumeric logins, but this should give you all the entry points you need.