Is there a way to restrict registration to users who present a valid invite code or token of sorts? I want to use Kratos for a system where users need to be invited to register.

Yes; You can send them a code using the recovery flow (and disable registration) https://www.ory.sh/docs/kratos/manage-identities/invite-users