Later comment in hope that the tech info will be useful for anybody.

Related to no.4 I presume that there is an outside Lemmy hack to achieve this purpose. The container/VM that is hosting Lemmy should use a separate DNS server that can serve records only for the pre-defined list of internet domains and deny the rest.

Please mind that this is just a supposition, I did not test it !

Anyway, thank you.

2. How will that block access of local users to remote existing communities (subscribe/post/reply/e.t.c.) ? I understand that only new created communities can be set to local only. Maybe I am wrong, can you explain or point to documentation link ?

OAuth 2.0 ?

If so, Authentik already has support for invite links, as stated in the link below.

https://docs.goauthentik.io/docs/users-sources/user/invitations

Anyway, thanks for the info, I will check next major version of Lemmy for OAuth.

No, thanks :)

How ? There is no option for it in the Lemmy server software.