By default, only admins have push access to all the repo's for an organization.
Everyone else, by default, has read-only access to the entire organizations private repos.
Each product team is allowed to specify how their own teams can access repos.
We also have 3rd party contractors and vendors work on portions, and they don't have push access.