Does `--no-verify` override the restriction via hooks, or are there some kind of server-side hooks that can be used?

no-verify cancels local hooks, remote hooks are unaffected.

Gitolite supports per-diectory/file write access natively, for gitlab you'd probably need to write your own.

Interesting. I'll have to do so reading into remote hooks!