There is dedicated git hosting software (such as gitolite and gitosis - most people in #git seem to prefer gitolite) that provides account-based access to Git repositories without providing any general shell access. Perhaps something like that could be set up on source.winehq, running on a dedicated, limiter user account?
Apparently you can also set a user's shell to git-shell to limit that user to the operations needed to push or fetch. Then again, if shell accounts with limited access weren't good enough then I don't know if something like this will help.
