Which bots should I allow besides Googlebot?

Keep Bingbot and any regional search engine that matters in your markets. Keep Google's inspection and rendering fetchers, or Search Console testing gives you misleading results. Keep the social and messaging preview fetchers, otherwise shared links appear as bare URLs with no title or image and fewer people click them. And keep your own uptime, performance and accessibility monitoring reachable.