TL;DR

I eventually settled on using Gitolite.

After thinking a bit about private git repos, I eventually settled on using Gitolite in an ad-hoc user.

Fiddling with 2FA seemed a bit brittle, also considering my level of knowledge of all the different shadings (read: level zero). As I said, the solution with a different user allowed me to adopt an already established solution for restricting access to Git operations only.

After a few months, I must say that it’s been easy to use Gitolite. I mostly copied from my past work, and reading the page about permissions was easy and interesting.

Cheers!