Best practices for protected branches

To anser my own question, deploy keys seem to have an Admin role. as described in Managing deploy keys - GitHub Docs
And by having the team members as maintainers, a protected branch, and only allow pr-commits, one should stop any pushes to branch, unless admin i.e deploy key

Read full topic