Branch policies is the correct option.

Branch policies enforce repository level rules so you can require pull requests, require a number of approvers, require successful CI checks, and explicitly block direct pushes to the protected branch. These protections are applied by the hosting system so the workflow is enforced automatically rather than relying on individual developers.

Lock the main branch is not the best choice because locking is a blunt action that can block needed automated operations and it does not provide the finer controls such as required reviews or status checks that prevent direct pushes while allowing approved merges.

Adopt a team guideline to use pull requests is not sufficient because guidelines depend on human compliance and cannot prevent someone from pushing directly. An enforced policy is required to reliably stop direct pushes.

Full AWS Practitioner Certification Question