Depends on what you want to do. For a free and open public relay, you should at least be able to block pubkeys, kinds and content, and be able to rate limit users somehow. You should also be able to watch activity logs somehow to at least manually check for spammy behavior from users.