I have disabled new revision creation. I have tested that updating an existing differential (arc diff 'HEAD^' ) still works.
Disabling differential updating can be achieved by editing neighbor lines in src/applications/differential/editor/DifferentialRevisionEditEngine.php.
Perhaps importing new commits from github can be postponed when the site eventually becomes read-only? Otherwise we lose connections from main branch commits to referenced differentials.
Current Login says Fetch Refs: refs/heads/*, refs/tags/*.