You could remove the origin on the repo and add it back only when you need to push.
Personally I do this: local machine with all repos, containers with a single repo without the origin. When I need to deploy I rsync new files from the container to my local and push.
This isn’t a horrible idea, but the risk isn’t really big enough to justify introducing that friction.