Manual:$wgInvalidUsernameCharacters

Details
Characters to prevent during new account creations.

This is used in a regular expression character class during registration (regex metacharacters like / are escaped).

Example
In case user names containing @, # and € should be prevented, the following setting is used: