The correct option is Do not allow invites.

Choosing Do not allow invites prevents non administrators from creating or inviting new accounts so only organization administrators and user access administrators can provision users through the admin console or through approved provisioning workflows. This setting enforces strict control over account creation and removes self service invitation paths that would allow unauthorized users to add accounts.

Allow invites only from approved domains is incorrect because it still permits users to invite others as long as the email domain matches an allowed list. That does not meet the requirement to restrict invitations only to administrators.

Allow any user to invite others is incorrect because it explicitly allows all users to invite new accounts which is the opposite of the desired restriction.

Require administrator approval for requests is incorrect because it allows users to request invitations and relies on an approval workflow. Requests still originate from non administrators so this does not satisfy the requirement that only administrators should be able to invite new accounts.

Full AWS Practitioner Certification Question