Blog creation woes with a simple 2 level, 2 subscription setup

I have 2 levels, free & members (monthly subscription) and I'm running a multi-site WP install. All I need at this point in time is the ability for members to create 1 site after they complete the paypal process. Free users should just be able to browse the site normally (might add shortcodes later on).

These are my levels, nice and simple:
Free user
Members

These are my subscriptions:
Free subscription (should NOT be able to create a site)
Member subscription (should be able to create 1 site)

Now I seem to be having trouble with the blog creation side of things...

Under the "Free user" level I have the "blog creation" dragged into the negative rules. For the "Members" level, I have blog creation dragged into the positive rules and have entered "1" for the amount of blogs they can create.

When I complete the member subscription through Paypal I appear as a member and I'm activated, but I cannot create a new blog. This is probably because under network admin -> settings I have "allow new registrations" set to "registration is disabled". But if I change this to "logged in users may register new sites" then anyone can create a site, even a free user, even with their blog creation disabled.

I'm a bit confused by all this. I don't want someone using the default wp-login.php form and creating an account through there and creating sites, so this is why I thought registration should be disabled through the network admin. Does the membership plugin not override the options under network admin? Is there a better way to do what I need?