I think realistically you need both client and server side checks.
If you were updating a password, server would need to check the password meets policy; you might as well check that client-side as well - provides immediate user feedback, but also keeps the load off the server for verifying invalid items. If user hacks their client to submit invalid stuff anyway, then it still doesn’t get through.
If it takes three frames minimum (assuming fixed 60fps) to select an item in a menu, then obviously anyone submitting a hundred menu items selections per second is a cheat who has hacked their client, and you can ban them. Client-side check keeps the load off the server, but server must verify. Also, you don’t want to instantly ban cheaters, because otherwise they’ll know what the limits are and push against them. Waiting for twenty minutes and then making it so that they can only connect to other known cheats strikes me as a suitably ironic hell; go have fun in there.