Basic syntax checking can be done with the 'filter_username' policy. From the FreeRADIUS documents:

# Filter the username
#
# Force some sanity on User-Name. This helps to avoid issues
# issues where the back-end database is "forgiving" about
# what constitutes a user name.

Example usage:

authorize {
filter_username
loop_prevent
operator-name
suffix
}

To filter out unwanted realms, such as 'hotmail.com' can be done simply by using the 'realm' command:

## Filter out NULL realms e.g. Username = fred
realm NULL {
}
## Filter out realms that aren't every going to be valid Govroam realms e.g. Username = fred@hotmail.com
realm "~hotmail\\.com$" {
}
realm "~hotmail\\.co\\.uk$" {
}
realm "~.*\\.3gppnetworks\\.org$" {
}
realm "~.*\\.3gppnetwork\\.org$" {
}
realm "~gmail\\.com" {
}
realm "~googlemail\\.com" {
}
realm "~live\\.com" {
}
realm "~outlook\\.com" {
}
realm "~yahoo\\.com" {
}
realm "~yahoo\\.cn" {
}
realm "~unimail\\.com" {
}
realm "~yahoo\\.co\\.uk" {
}
realm "~myabc\\.com" {
}

alternatively

check_bad_realms {
if (&User-Name) {
## reject usernames that end with realms that are never going to be govroam/eduroam realms
## is there a way to automate this??!
## stuff here will be matched for just eduroam
if (&control:Proxy-To-Realm =~ /^PROXY-JANET-EDUROAM$/)
if (&User-Name =~ /test\.net$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
if (&User-Name =~ /@.*bathnes/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
}
## stuff here will be matched for just govroam
if (&control:Proxy-To-Realm =~ /^PROXY-JANET-GOVROAM$/)
if (&User-Name =~ /that\.host$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
}
## stuff here will be matched for both govroam and eduroam
## Common realm provided by phone manufacturers by default
if (&User-Name =~ /3gppnetwork\.org$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
## Username is not an email address.
if (&User-Name =~ /gmail\.com$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
## Ends in '.'
if (&User-Name =~ /bath\.ac\.uk.+$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
## Ends in a single character - all TLDs are 2+ characters.
if (&User-Name =~ /\.[a-z0-9]$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
## All subrealms should have more than one character
if (&User-Name =~ /\.[a-z0-9]\.uk$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
## Misspellings and misunderstandings
if (&User-Name =~ /ac\.uk\.com$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
if (&User-Name =~ /\.acuk$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
if (&User-Name =~ /@ac\.uk$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
## Starts with a '.'
if (&User-Name =~ /\.bath\.ac\.uk$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
## Some typical inappropriate realms.
if (&User-Name =~ /@myabc\.com$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
if (&User-Name =~ /@.*hotmail\.co/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
if (&User-Name =~ /@.*live\.co$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
if (&User-Name =~ /\.local$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
if (&User-Name =~ /\.guest$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
if (&User-Name =~ /@.*gmail\.co/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
if (&User-Name =~ /googlemail\.com$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
if (&User-Name =~ /outlook\.com$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
if (&User-Name =~ /@.*yahoo\.c/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
if (&User-Name =~ /unimail\.com$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
if (&User-Name =~ /blueyonder\.co\.uk$/) {
update request {
&Module-Failure-Message += 'Rejected: Bad Realm'
}
reject
}
} else {
update request {
&Module-Failure-Message += 'Rejected: erm... WTF?!'
}
reject
}
}

Many thanks to Matt Richards from Bath University for this code.