Basically, a user on any lemmy instance can subscribe to a group on any lemmy instance (as long as the instance admin hasn't blocked the other instance). So then they see activity on that group on their home instance.
Moderators are appointed by the sub creator, and they can come from any instance. But of course, an instance admin can block/ban/delete content from their own instance, even if they aren't a moderator. The difference is, the moderators moderation action will federate to other instances, but the instance admins will not.