People have been asking about Webmention support before so I thought that I would give my solution here. Mind you, it is neither trivial nor very generic, but maybe it can serve as an inspiration to someone.
A while back I implemented my commenting functionality: comments are always pre-moderated, blog owner receives a notification and a review URL. Once approved, comments are added to the repository and become regular Hugo content.
I now added Webmention and Pingback support using the same principle. Whenever a request is received, the blog owner has to review it. The source page is only downloaded when the review interface is opened, this avoids a number of potential security issues. In this step the source page is being validated (the link has to be present) and metadata is extracted. If approved, it is added to the repository with this metadata just like a comment would be, and it is displayed in the blog only minimally differently.