Custom Response Page - best/good and BAD practice

It all depends on what you want from the response page. Do give them the support ID as you will need it to find the violation they hit. Don't give them any details on why they were stopped or what kind of system you have.

It is easy to think of the blocking response page as a tool to help your employees and customers, but your employees and customers will call in with their support ID. The other people who will find it helpful (and won't call in) are people who are trying to bypass the ASM or attack your website.

Probably the best option is to have your company logo, the support ID, and a number to call to get assistance, or something equally simple.