List defines all possible services that the client can request from your system. Once client makes the request, ServiceRequest event will be fired, at which point you can deny the service if you want, or change it (reasonably) to something else.

For example, if some guest user tries to execute command prompt (stShell value), you can change it to execute some external program (stExecute) or even manually write the custom message and close the connection.

Obviously, if user requests SFTP subsystem, changing it to something else (like stShell) doesn't make sense, because the client program on the other side is probably only SFTP capable, so you should close the connection if you don't want to approve it.