I think a combination of the first two options would be good. Make a captcha necessary to be a candidate for invite, then achieve a smallish number of invites to get in type of thing. Just a captcha would provide minimal bot protection since one could just do the captcha, then let the bot run wild.