They should work with the FBI to inform companies of foreigners causing trouble with their systems. And they should develop secure protocols and encryption for the benefit of the government and public. Any NSA-collected data should be inadmissible in any court, and they should not be backdooring encryption. They also shouldn't collect any data from purely US-internal networking. On that point, it would be great if packets with start and end points within the US were virtually guaranteed to stay within the US when being routed, but I don't know enough about internet infrastructure to tell whether that's possible.
When Trump gets elected, I bet he'll take a more direct route here and just sanction them or disconnect their internet or something, which should put a stop to it. Then we won't need to rely on the NSA for defense as much.