So:

A blocks C

C does not block A

B does not block any

Each instance has a local version, but there is a “True” version, which is located at the instance where the community is hosted. The “True” version gets sent to everyone else

User from instance A post in a community hosted in instance B. First the packet gets processed at instance A, instance A updates it’s local version of the community, the local version than gets sent to the instance where the community is hosted. Instance B received this information. Instance B updates it’s “True” version. Then the “True” version is sent to everyone else. Instance C receives this, and updates its local version. They’ll see any post/comments from instance A.

But if your reverse this, everything would be same except the last part. When Instance A receives any update, the instance first checks where each post/comment comes from. If a post/comment is from an instance in the block list, it is discarded. Therefore, users in instance A do not see those content from instance C. That’s what defederation is, a filter in their end.

Instance A will reject any direct connections to instance C, both inbound and outbound. And instance A also scan any incoming updates from any other instances, and discard any post/comments in the block list. But there is no way for instance A to send content to instance B while not letting instance C see it. Instance B decides who they’ll send it to.