There seems to be no official way to prevent pushing to a remote in Git, but people often recommend setting the push URL of a remote to something invalid. (Can't clear it fully because Git would fallback to the fetch URL).

git remote set-url --push origin no_push

It would be good if the VS Code Git SCM provider could check for git:, ssh: and https: URLs and if it finds an unsupported URL format, hide the Push part of the Sync button in the bottom bar. Pulling should continue to work.

In case white listing protocols is deemed too potentially disruptive (maybe people are using custom protocols?), a black list approach could be considered where no_push (and other values?) would cause the push icon to be hidden.