VSTS - prevent push to master but allow PR merge

I do not have reputation points to comment in a answer, so I will post a new one here.

When you set your master branch policy to Require a minimum number of reviewers, the master branch automatically will be protected. You will not be able to push any commits. In order to make any changes, you will need to create a new branch, and create a pull request to merge the modifications.

Branch policies already do exactly what you're saying. When a branch policy is in place, PRs are required.

Make sure your developers don't have the "Exempt From Policy Enforcement" permission.