whice all server response codes should be included to be blocked by ASM

in principle it is up to you, you can see what the F5 blocks / allows by default here:

https://support.f5.com/csp/article/K7922

in the end it depends on what you feel isn't safe or might reveal more then you want.

btw i see you open a number of ASM questions, perhaps looking into working with your local F5 team or an F5 partner would be a good idea. ASM has a lot of options and is easy to do wrong.