1. Insert user data into wp_users table. Create a page called "Activation" or similar to it and get the ID of that page. An activation email will be sent with the activation link to the user.

function new_user($data) {

    // Separate Data
    $default_newuser = array(
        \'user_pass\' =>  wp_hash_password( $data[\'user_pass\']),
        \'user_login\' => $data[\'user_login\'],
        \'user_email\' => $data[\'user_email\'],
        \'first_name\' => $data[\'first_name\'],
        \'last_name\' => $data[\'last_name\'],
        \'role\' => \'pending\'
    );

    $user_id = wp_insert_user($default_newuser);
    if ( $user_id && !is_wp_error( $user_id ) ) {
        $code = sha1( $user_id . time() );
        $activation_link = add_query_arg( array( \'key\' => $code, \'user\' => $user_id ), get_permalink( /* YOUR ACTIVATION PAGE ID HERE */ ));
        add_user_meta( $user_id, \'has_to_be_activated\', $code, true );
        wp_mail( $data[\'user_email\'], \'ACTIVATION SUBJECT\', \'HERE IS YOUR ACTIVATION LINK: \' . $activation_link );
    }
}

2. Check activation status while logging in:

// override core function
if ( !function_exists(\'wp_authenticate\') ) :
function wp_authenticate($username, $password) {
    $username = sanitize_user($username);
    $password = trim($password);

    $user = apply_filters(\'authenticate\', null, $username, $password);

    if ( $user == null ) {
        // TODO what should the error message be? (Or would these even happen?)
        // Only needed if all authentication handlers fail to return anything.
        $user = new WP_Error(\'authentication_failed\', __(\'<strong>ERROR</strong>: Invalid username or incorrect password.\'));
    } elseif ( get_user_meta( $user->ID, \'has_to_be_activated\', true ) != false ) {
        $user = new WP_Error(\'activation_failed\', __(\'<strong>ERROR</strong>: User is not activated.\'));
    }

    $ignore_codes = array(\'empty_username\', \'empty_password\');

    if (is_wp_error($user) && !in_array($user->get_error_code(), $ignore_codes) ) {
        do_action(\'wp_login_failed\', $username);
    }

    return $user;
}
endif;

3. Below function will get execute if the user clicks the activation link in the email.

add_action( \'template_redirect\', \'wpse8170_activate_user\' );
function wpse8170_activate_user() {
    if ( is_page() && get_the_ID() == /* YOUR ACTIVATION PAGE ID HERE */ ) {
        $user_id = filter_input( INPUT_GET, \'user\', FILTER_VALIDATE_INT, array( \'options\' => array( \'min_range\' => 1 ) ) );
        if ( $user_id ) {
            // get user meta activation hash field
            $code = get_user_meta( $user_id, \'has_to_be_activated\', true );
            if ( $code == filter_input( INPUT_GET, \'key\' ) ) {
                delete_user_meta( $user_id, \'has_to_be_activated\' );
            }
        }
    }
}