First, enable "Always suggest updating pull request branches". This improves DX.
Then add a branch protection rule for the main branch with "Require linear history". This requires that PRs would otherwise fast forward.
Then disable everything but rebases. Rebases where the history doesn't need to be changed are fast-forwards. In fact, as far as I know, `--ff` isn't anything special other than "fail with an error if a rebase isn't just a fast-forward". There's no special functionality.