github - how to restrict actions that a user can use?

To restrict user to a specific type of action, we can do this by going to your repository -> Settings -> General and under workflow permission. Select "Allow user, and select non-user, actions and reusable workflows"

And then as you can see here, we are limiting user to use only docker/login-action@v3. 

Then you will see an error appear when user tries to use action/checkout@4.