If you don’t want to give users access to the WordPress admin screens and you don’t want to use a premium plugin, you should create a form in a page and use wp_insert_post with the submitted data.
In your case, the “post_status” parameter could be used to “moderate”:
$post = array(
'post_title' => $_POST['title_field'],
'post_content' => $_POST['content_field'],
'post_status' => [ 'draft' | 'publish' | 'pending'| 'future' | 'private' | custom registered status ] //Set the status of the new post.
);
wp_insert_post($post);
The wp_insert_post function should take care of sanitizing the data before inserting it into the DB, but I recommend to double check and add filters if necessary.