Can't they just have the Copilot user permission to be readonly from the current repo.