That's what gitolite does with some helper scripts for creating/setting up the repositories, adding metadata to the configs, etc. That way your `git` user can be set to reject ssh login attempts. The projects are managed by pushing a config to a gitolite admin repository.