Technically speaking, no: arc land uses git push and runs on the user's machine, so there's nothing we could do that a user can't bypass.

You could use the herald rules for "Doesn't have an approved Revision", but this too can be tricked by a sufficiently competent user.

For 100% security, you'll need to implement a server-side "arc land" feature, and only allow this flow to actually pushes (or pushes to a specific branch).

I'm pretty sure the Automated Landing and Repository Automation allow for this kind of implementation.