Using their name in a domain name to criticize them is reasonably well protected. However, the rest of it is a minefield.
You cannot lie, or link to lies.
Which means you better be very good at distinguishing the provable truth from your mind's definition of the truth. "Alternative facts" are not enough; you will need to be able to back up any claim in a court-of-law.
Courts have ruled that when a website owner links to other pages which are defamatory, the website owner is being defamatory by doing so.
Even if you are a scrupulous Fair Witness, you also run the risk of the company coming after you claiming you lied, simply as a "Strategic lawsuit against public participation".
Be in California or other SLAPP state
Fortunately, certain jurisdictions have laws discouraging harassment-to-silence-you lawsuits. In California, you can quickly get such a case dismissed, and even get legal fees back in some cases. You'll want to make sure to set up a corporate entity so that the "person"=entity they would be suing is a citizen of such a state, and if you personally are not a citizen of such a state, you'll need to take extreme measures to assure they don't do an end-run around the corporate structure and sue you personally. How to do this is beyond the scope of this answer.
230 lays out a principle of law which has held the test of time: that a service provider shouldn't be held liable for the actions of its users or there will be a chilling effect which would make any social media impossible. If Joe defames Jodi on Facebook, we can't have Jodi suing Facebook, or there won't be any Facebooks.
So you want to understand how Section 230 works (and how it does not work; pay close attention to BadBusinessiBureau's experiences)... and architect your site around it. For instance, it applies to user-generated content, so architect your site so it is mainly a clearinghouse for complaints from other people. Then, when someone says something horrible and the company threatens you, you can shrug and say "Gosh, we (the proprietor of the website) had no idea that was there". If you promptly delete it, it would be difficult for the company to persuade a judge that you should be liable for the content. Don't push this too far, see case law for what works and what does not.
This adds a layer of obfuscation to what the company must do to obtain a productive lawsuit out of you.