How to restrict team members from merging the changes that they did in there forked repository to base repository?

I have created a base repository and sent request to my friend to become the collaborator of my project. He forked mine repository and did some changes there. And then he created a pull request for me to merge changes that he did. But along with it he is also getting the option for merging the changes to base repository i.e. mine repository without my permission. How i can restrict it ? I mean how only can merge the request instead of my all team members.

Actually, i have tried it on a single PC where i have opened the main account on browser and another account on the incognito tab. And created the pull request from my another account to main account but in my another account i have got option to merge changes to base repository which is of my main account and when i do so the changes reflects to my main account GitHub repository also.

Help me fixing it. If i am wrong somewhere then tell me the procedure that my friends only can create pull requests and i will merge them after check.

To protect a branch on your repository GitHub page:

1. Open Settings tab at the top right
2. Click Branches in the left-hand column
3. Select the branch you want to protect/restrict access to
4. To the right of Branch Protection Rules click Add Rule
5. The Branch name pattern field is the exact name of the branch you want to protect.
6. select Require pull request reviews before merging OR select Require review from Code Owners
7. Click the green Create button at bottom and you're done!