Since the original question / answer, Github has added a new option for this to the restricted branches UI which allows you to set this up.
Require pull request reviews before merging When enabled, all commits must be made to a non-protected branch and submitted via a
pull request with the required number of approving reviews and no
changes requested before it can be merged into a branch that matches
this rule.
To find it go to Settings > Branches > Branch Protection Rules
and click ‘Add Rule’.
Then, enter the name of the branch you want to protect and click the checkbox to require pull request reviews before merging.
By default, this only stops people who are not moderators. There is also another checkbox later down for ensuring that even moderators cannot merge.
