I checked with the MSM Eng team - they replied:
Well, breaking inheritance is one way. Doesn’t prevent rollout per se, but eliminates effect a rollout would have.
Beyond this, “rollout permissions” is a common request, to prevent certain user groups from rolling out pages, or to enable just certain groups to perform rollouts. AEM does not have that. The way AEM Users handle it is with governance. Tell users to not rollout pages and trust they won’t. It’s not like an action that can be performed on accident.