How to forbid only one developer to push to a protected branch without giving everyone else master role.

We have a protected branch (to prevent deletion or force push), but every developer is allowed to push to it, however, there is one developer that keeps doing things wrong, and we would like to forbid him from pushing to master, but still be able to push his local branch to perform a merge request.

If we allow only masters to push, we would have to give master role to every developer except the bad developer. If we set "Allowed to merge" to masters+developers, the bad developer can merge his own branch.

Is there a way to acomplish this ?