The latest advice (e.g. from NIST) recommends that user's password are checked against known breaches and compromised passwords are forbidden.
What are some relatively straightforward steps that a regular web dev who is not a security expert can take to implement this? Just knowing what breaches to use and where to download them is a start. It would also be helpful to have an opinion on how far a typical site should go (e.g. it's probably not necessary to continually monitor breaches and update your list).
Edit: Mostly interested in non-SAAS approaches