Wire the checkers, then decide what each signal does: allow, flag or block.
Out of the box the Mask blocks nobody. It scores every visitor and shows you the numbers; you turn blocking on yourself, once you've seen a couple of days of real traffic.
The Bot protection (WAF) switch has Monitoring, which only records, and Filtering, which drops bots scoring below the confidence threshold. Start on Monitoring.
Every individual signal — VPN, proxy, duplicates, invalid phone, each hardware check — then carries one of three actions. Allow lets it through unmarked, Flag lets it through but marks the lead for quality control, Block never sends it to the partner. An explicit Block wins over the numeric score, so a rule you set always beats the aggregate.
Some offers tolerate more risk than others, so the actions above are overridable per provider, partner, flow or country with a Custom Rule. External checkers auto-run when a rule needs a signal they provide.