My 13yo got contacted by a stranger online—what now?

This scared the hell out of me. My son told me a grown man messaged him on Discord asking to play a game together and wanted to move to a private chat. I told him no and he blocked the person, but my heart is still racing. We talked about it that night but I don't want to overreact and make him secretive about online stuff. How do you balance warning them without making them paranoid?