I think carefully managing our users' pull refs and have a split "pure" origin vs "shared refs" remote is a good start