If you want to fine-tune who can do what a simple way is to say that all users not registered has no branch in .gitroot/users.yml:
1noAnonymous:
2 branches:
3 - name: "*"
4 users: []
You will need to add each ssh key of your contributors see add an user to do it.
Be sure to have at least one user in main branch to be able to modify it, else no one will be able to modify anything.