Short story

Create a remote (or use an existing one) and set its push url to something funny.

$ git remote add origin-readonly https://url.to/remote.git
$ git remote set-url origin-readonly --push "You shall not push"

Long story

If you're using git-flow, and I think most of you are or tried it at least once (if not I recommend you read this article), you've most likely been in this situation.

Say you have a feature branch, feature/awesome-feature, and you want it to track the remote develop branch to keep it up-to-date with the latest changes without risking to accidentally push your feature to it. Set up a read-only remote as shown in the "Short story", set it as your feature branch's upstream, et voilà.

Make your branch track the read-only remote branch you want.

$ git branch feature/awesome-feature -u origin-readonly/develop

Now you can pull latest changes from develop, but you can't push.

$ git pull
$ git push
# Pushing to You shall not push
# fatal: 'You shall not push' does not appear to be a git repository

Note that you can still push on whatever remote you want by specifying it explicitly.

$ git push origin HEAD