What the check is doing
Junk accounts join at scale and post immediately. They do not read, and they very rarely complete an interactive step. A join check turns that speed against them: one small action stands between joining and posting, and almost nothing automated bothers with it.
Keep it to one tap
The temptation is to make the check hard. Do not. Every extra second costs you real members, and the accounts you are trying to stop are not the ones making the effort. One button, a short time limit, and removal on timeout is the shape that works.
Decide what happens on failure
Removal rather than a ban is the sane default for a public group, because a slow human should be able to try again. Save bans for accounts that come back repeatedly.
Pair it with the filters, not instead of them
A join check stops arrivals. It does nothing about an account that sat quietly for a month before posting a link. Anti-spam, link filters and warnings cover that, and they are separate toggles for a reason.
Check it with a spare account
Join your own group from another account and watch what a newcomer sees. Most badly set up checks are obvious in ten seconds from the other side and invisible from the dashboard.
What to watch after a week
Look at how many joins complete the check. If a large share of real people fail, the time limit is too short. That number moves as the group grows and is worth rereading every so often.