Whats the best way to actually extract the master branch out of origin and put it in its own location?
Simply add a new remote referencing an empty bare repo, and push master to it.
git remote add newlocation /url/to/bare/repo
git push newlocation master
That being said, for fine-grained repo/branch protection, adding an authorization layer like gitolite to your "master" repo remains the surest way to protect what you want how you want it protected.
See that answer for protection examples.