What is the proper permission settings to create a moderated, private organic group (in commons 3)?
I understand your confusion. In Drupal Commons, follow is not the same as registering as a group member.

If you check off the non-member checkbox on the Subscribe to group line then non-members can apply to register for that group. AS you have your other settings then an administrator can approve this registration.

Becoming a member of a group allows you to post. However, in the default configuration, posts in even private groups are visible unless additional permissions are applied and users may still follow the group.