Sounds like a submodule with restrictions for push access managed on the repo level of the submodule.