I have a single repo in which I have 2 user groups:
I do not wish to give read/write access of my maste
maste
In Git itself you can use the "pre-receive" hook in the server to protect for writing in a branch to some user.
Using this hook you can apply your restriction policies for each file in the push.
Here you can find an example.