How to Make a git Repository 'pull only'

Question

I am setting up a development environment on a shared server for multiple developers. I will have one repository that houses all code used in production, and many others used for development by different members of the team. What I would like is for the production repo to be 'pull only'. Users can pull from it and get production changes locally whenever they want, but pushes need to be handled by a production admin, or at least require a password. Something like:

[user@machine /devroot/myrepo]$ git pull $PRODUCTION master
From <location>
*branch             master       ->  FETCH_HEAD
Already up-to-date 

[user@machine /devroot/myrepo]$ git push $PRODUCTION master
error: user `user` is not authorized for this action

Or

[user@machine /devroot/myrepo]$ git push $PRODUCTION master
HEAD @ `$PRODUCTION`-Please enter password:

I believe I could do this with file permissions, but that doesn't strike me as an elegant solution. Does git have something like this built in?