That’s how I understood it. There is maybe a way to blacklist everything (like using a wildcard) or disable federation? I don’t know. Maybe I will try to run my own personal instance just to learn how it works :)

Do they need to approve each and every instance manually? I thought it would happen automatically as soon as someone is trying to subscribe to a “channel” of another instance. No?