Acl extension to prevent pushing into default branch

[Felix Dorner]

Hi,

I need a setup a repository so that only users in a certain unix (LDAP
managed) group are allowed to push changes to the default branch.
Everyone else should have 'read' access to all branches and write
access to all branches except the default. Is this possible with the
ACL extension, and if so, could someone please give an example?
Especially I don't seem to find a solution that specifies distinct
permissions for read (pull) and write(push) operations.

Thanks,
Felix