Bluesky is not a part of the fediverse. If they don't want to use standards and the devs cry about how it is absolutely impossible to integrate the features of ATProto into ActivityPub, then they can fuck off.
Why would they need to understand? Just tell them that it's needed to play on the server and set it up for them. Whenever they want to play, they can use the VPN.
You should isolate it. Use Docker or Podman or any container solution to put the server in a container for isolation from the main system.
Any external directory outside the container the server won't write to should be in read only mode.
If the server is only for your friends. Stop exposing your network to the public and instead use VPNs.
You can't get rid of bots, nor spammers.
The only thing is that you can have a more aggressive automated punishment system, which will unevitably also punish good users, along with the bad users.
I pay 5 euros for a VPS at Hetzner and self host my own SearXNG metasearch engine without compromising my privacy.
Unlike Kagi, I can search without limits and without the AI stuff that even Kagi has started getting into.
How does it not relate to your comment?