I'm unsure as I never tried this on github before, but: Isn't it possible to limit by default who has the permission to even create a PR on a particular project? We used gitlab internally, selfhosted, for ages, and even there in a rather small team we had settings like this to keep things somehow "controlled"...