The types of content that can be blocked are described by strings. Most used are 'image' and 'object'. Other possible values are 'other', 'script', 'stylesheet', 'document', 'subdocument', 'refresh'.
Set the pref 'permissions.default.<typename>' to what you want to do with those things by default. 1=allow, 2=block, 3=no third party.
You can set lines in hostperm.1 to the same values, for example
host image 2 example.com
for third party, the host is the host of the image, not of the page.