In ACP you have this settings: Spam Measures admin_config_settings.php
If you enable this: "SPAM - Disable URLs In Posts" URLs are blocked fine.

But new user can also not post smilies.
I think smilies should be fine to post.

It's very complicated... and almost unuseful... if the user is going to be "verified" later, everything will be fixed.

I wouldn't care.