Can I mark a GIT remote as read only?

You could shut off default pushes via

git config push.default nothing

or for stronger protection on a specific remote you could break pushes to that remote entirely by e.g.

git config remote.origin.pushurl "you really didn't want to do that"

git remote set-url origin --push "hey, stop pushing"

Note that the following removes an explicitly configured push URL, but then pushes will use the fetch URL, so not what you want:

git remote set-url origin --delete --push ".*"