There is a post[1] on the gitbutler blog where they collect a subset of defaults that allegedly git core developers use. It's where I got most of my config from.
receive.denyCurrentBranch should be updateInstead by default (or at the very least mentioned in the help message, rather than it recommending ignore or warn or refuse, none of which do what is wanted)