(new) GitLab engineer here. This is correct, it can be set to allow merge requests from "Only Project Members", or disabled entirely. You can also disable pretty much everything else as well, if desired.

Disclaimer: nobody submits contributions to my hobby projects anyway.