Later comment in hope that the tech info will be useful for anybody.

Related to no.4 I presume that there is an outside Lemmy hack to achieve this purpose. The container/VM that is hosting Lemmy should use a separate DNS server that can serve records only for the pre-defined list of internet domains and deny the rest.

Please mind that this is just a supposition, I did not test it !

Anyway, thank you.

2. How will that block access of local users to remote existing communities (subscribe/post/reply/e.t.c.) ? I understand that only new created communities can be set to local only. Maybe I am wrong, can you explain or point to documentation link ?

OAuth 2.0 ?

If so, Authentik already has support for invite links, as stated in the link below.

https://docs.goauthentik.io/docs/users-sources/user/invitations

Anyway, thanks for the info, I will check next major version of Lemmy for OAuth.

No, thanks :)

How ? There is no option for it in the Lemmy server software.

I guess there are ways to prevent such outcome by pre-selecting subscribers by level of technical knowledge on the subject.

An online test (chat like) is applied also by private torrent trackers to select uploaders also by tech knowledge of the subject before they are accepted. The same system can be extended.

Unfortunately, this is possible only where are many wanna-be subscribers to choose from the pool.