Permissions
Keep a role from deploying, and let a role whose blueprint switches every permission off deploy anyway.
Keep a Role From Deploying
Every role may deploy by default. To withhold it, set the deploy permission to false in the role's blueprint:
site/blueprints/users/editor.yml
title: Editor
permissions:
johannschopplich.deploy-trigger:
deploy: false
Users of that role don't see the button, and the server refuses their deploy request.
A role blueprint that sets "*": false switches deploy off too. To let that role deploy, set deploy: true under johannschopplich.deploy-trigger next to the wildcard.