[support] approve blog postings

I have a site at <www.panevinosb.com> where we have a blog. What we want is for any real customer to post comments about their experiences there, and also for the manger to post about upcoming events the restaurant is participating in.

What's happening is that the blog gets spammed and I have now turned off "create new content" for anonymous users. I have Captcha which is turned on for everything.

I am sure somewhere I saw where an admin or other role, could preview this type of postings, and delete or publish at their discretion. I can't figure out how to not have this "publish" upon creation??

thanks,

Pia