You could use Regex (Regular Expression), /^[a-zA-Z]{3,}$//^[a-zA-Z]{3,}$/
would for instance allow a minimum of 3 characters behind the comma would be the max value.
As for numbers it would be something like this /^[0-9]{3,}$//^[0-9]{3,}$/
http://regexr.com/ to test your regex en examples
And iI would do this before the user is saved with the users.onBeforeSaveUserusers.onBeforeSaveUser
Event in a plugin.