I chose an instance ran by the same person who owns the mastodon instance I am on, it’s not that popular compared to the big Lemmy instances.
For my mastodon instance I chose one based off of: being on the official list, region, how many people post on that instance in a day (too many posts = too many users), what kind of stuff they post and the rules I have to follow. You could follow the same idea with Lemmy.
For the most part, I ignore the main instance and just look at my subscription feeds through a 3rd party app. So far, nothing bad has occured from being in a small community.
Also, look for posts on Lemmy or Mastodon about updates for a particular instance. My instance is being updated often and is actively geared against the spam bots and ddoss attacks from the past month.