Mostly correct. The only slight correction is that they can delete posts and block users from their own communities. So hypothetically, if User@serverone.lm posts starts being super rude on a community in servertwo.lm, then the admins of servertwo.lm can delete posts in their instance and/or block the user from participating there. That does not stop User@serverone.lm from participating in their own instance or any other.
The defederation thing is very much a last resort. If EVERYONE in serverone.lm is causing problems, and the admins of serverone.lm refuse to do anything, then the admins of servertwo.lm might decide it's not worth the hassle to ban individuals and ban the whole instance.