Github doesn't have fine-grain permission settings, or at least not fine enough to disallow push but allow merging pull-request. Pre-receive hooks would also allow to distinguish pushes and pull-requests, but they can't be used on GitHub. So you have two options:
- forbid people from directly pushing to GitHub, even if technically they can
- use GitLab along with Gitolite, which will allow much more powerful permissions, and provide the same kind of functionalities than GitHub