In the pending systems there is only an option to Approve -- there's no Deny or Remove. The work-around is to Approve it, and then remove it from the Configured Systems.
In my case, I got an additional Pending System, because I changed the minion_id of the system, so it showed up as a different system. However, I could imagine other scenarios where I might want to remove a pending system, or permanently deny/block all future requests from a specific client.
We plan to add the ability to reject pending systems in the future. You can currently reject minions using the command-line on the server (c:\Program Files\National Instruments\Shared\salt\salt-key -r <ID>).
However, it currently has the downside that it completely stops the salt-minion service on the target. If you are using a Linux RT target, it results in the target no longer announcing it's mDNS service, which makes them difficult to discover and add to a different server in the future. We plan to work with Salt to upstream a change to cause the minions to go back to the disabled state instead of stopping the service before we feel comfortable exposing the ability to Reject targets in the web interface.