> That's not something that you can do in git: it's all or nothing.

That is partially incorrect; you can restrict writes via hooks but not reads; you'd need a workaround like submodules

Does `--no-verify` override the restriction via hooks, or are there some kind of server-side hooks that can be used?