I understand that you have questions regarding the UX when users log in with an unverified email address.
By default, unverified email address users are allowed to sign up and authenticate onto your application.
However, if you would like to verify these users before logging in, then I recommend using a Force email verification Rule to accomplish this task. You can find this Rule template in your Dashboard>Auth Pipeline>Rules>Pick a Rules template.
Please let me know if I have addressed the issue. Otherwise, could you please clarify what your desired UX flow is?