Stash is not availabe to play at all in the current online implementation.
Possession will not be part of a randomly generated set (possible exception is that it may come up in the Black Market deck if a Potion costing card is in the Kingdom).
From the
rules7.1 The default is playing on the Shuffle iT platform (dominion.games), with the point counter enabled, on fully random sets including all expansions up to Nocturne.
7.2 The default match configuration may be changed by mutual agreement between both players. (e.g. disable point counter, always include/exclude some cards, etc.).
So if players use the default way to start a game, they will (with the mentioned exception) not encounter Possession. If they are using option 7.2, they should be on the watch for inclusion of cards by the game host that they do not want to play against.