How do I configure gitlab CI jobs to run on protected branches only?

I am trying to configure a gitlab CI job to run only on the restricted branches, but I cannot find an only directive to do this.

In Gitlab 11.11 you can check this accessing the environment variable CI_COMMIT_REF_PROTECTED

only:
    variables:
        - $CI_COMMIT_REF_PROTECTED

Reference:

• https://docs.gitlab.com/ee/ci/variables/predefined_variables.html
• https://docs.gitlab.com/ee/ci/yaml/#onlyexcept-advanced