can I verify user before his first login?

You can turn off the Activation emails from Admin--> Email notifications--> Requester notification. And then once the contact is created you can check the unverified contacts from the contacts tab--> filter out the unverified contacts by clicking on the view at the top of the contact page. You can then trigger the activation email manually for those you would like to login to the customer portal.