One possibility is the project sharing or access setting. I'll show it in the sharing dropdown (screenshot) but you can also find this in the access section when you edit the project.
In this screenshot I show how I have shared a project with a team using "contribute" access, and then clicked on the additional options to click off the ability to Log hours.
This sharing is sent down to all project tasks (inherited permissions) so you MIGHT need to re-share the tasks and make sure the "log hours" is checked on (either way, I expect you to test your system thoroughly). So basically this two step process will remove the ability to log hours on a project and give that ability to the tasks. Depending on what you discover in your experiment, it may end up being a bit onerous, but maybe you can control the sharing using templates, and share it very broadly.
