Allow public to post on blog

If you don’t want to give users access to the WordPress admin screens and you don’t want to use a premium plugin, you should create a form in a page and use wp_insert_post with the submitted data.

In your case, the “post_status” parameter could be used to “moderate”:

$post = array(
    'post_title'   => $_POST['title_field'],
    'post_content' => $_POST['content_field'],
    'post_status'  => [ 'draft' | 'publish' | 'pending'| 'future' | 'private' | custom registered status ] //Set the status of the new post.
);

wp_insert_post($post);

The wp_insert_post function should take care of sanitizing the data before inserting it into the DB, but I recommend to double check and add filters if necessary.