[Update] Changes to ADF are deployed using the new CI/CD flow here. SO developers don't need to click publish to manually push changes to create a ARM template.
So developers need to have permissions to develop within ADF but don't need to access to the Publish buttons.
To restrict access to the Publish/Publish All buttons, based on this RBAC page, is to assign the Contributor role but remove the Data Factory Contributor role.
I've done that but the Publish button is still enabled.
Is there something else I need to do?