How do you enforce that with Git? Any time you create a branch, it's local until you push it.

But anyhow, just give people private repos on the server. What I do is push my private WIP branches to my home directory on the server, and once it's ready for code review and merge, push it to the central repository.