I just need enough permissions to know that you have > 0 repos, public or private. I didn't see anything between just-email and all-the-things in their oauth docs, but I might've missed something while rushing through. Do you know otherwise?
I'm not sure why having an empty account is something you care to filter on. If someone really wants to pretend to be a dev, forcing them to click "Create new repo" before they sign up isn't going to provide much of a barrier. You're already basically taking them at their word so I'd recommend just dropping the requirement.