I prefer limiting to DJB ciphers where possible (the AES-GCM suites might also be helpful, but otherwise anything below is legacy crypto):

    Ciphers chacha20-poly1305@openssh.com
    KexAlgorithms curve25519-sha256@libssh.org

AFAIK, if RSA is off the table, then the moduli file isn't necessary.

    RSAAuthentication no

SFTP-only accounts are advised in "SSH Mastery" by Michael Lucas to follow this form:

    Match Group sftponly
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTcpForwarding no

I'm still seeing the external sftp subsystem in latest loads (last seen is Microsoft). Internal is better, and required for chroot.

    Subsystem sftp internal-sftp

I like to put SFTP users on a separate server, just for them, and turn some other things off:

    PermitTunnel no
    X11Forwarding no
    PermitRootLogin no
    AllowTcpForwarding no

Those are some settings that I would prefer.

That's brilliant!