You can selectively deny and modify pushes. For example, gitolite features read/write permissions per branch. You could allow unknown pushers to create new branches but never modify existing ones. UI wise you want to mark those rogue branches and filter them out on most occasions. For example, just have them in a "sub-dir".

It should feel like the inverse of the "check out pull requests locally" trick. https://help.github.com/articles/checking-out-pull-requests-...