How do I configure repo on GitHub so that everyone can see it, but I can select people who can make changes?

I want to know how to make a repository so that ideally it shows up on my profile (so it has to be public I guess), but no one except for a few people I select can push and make pull requests

The reason why I want this to be set up like this is because I'm making a game with my friends that may end up on steam and I'm worried that if we do decide to sell it, and somebody from the outside pushes his own changes to that repo we will no longer have 100% ownership/copyright of that project.
I know I could just make it private, and add my friends as collaborators, but I'm also looking for a game dev job and would like to have that project as a part of my portfolio.

I tried making a public repo, and add collaborators, but it didn't stop non-collaborators (which were my alternate accounts with which I pushed the changes. To make sure that GitHub sees them as seperate accounts I changed user.name and user.email in my local repository's config file before pushing) to push to main. It even added them as contributors.

as you can see Bebzon123 is a contributor

I used these bash commands to push changes

Zibzą77@DESKTOP-DTPUJI4 MINGW64 ~/Desktop/non collaborator repo
$ git clone https://github.com/MichalNawrocki77/collab-test.git
Cloning into 'collab-test'...
remote: Enumerating objects: 3, done.
remote: Counting objects: 100% (3/3), done.
remote: Total 3 (delta 0), reused 3 (delta 0), pack-reused 0
Receiving objects: 100% (3/3), done.

Zibzą77@DESKTOP-DTPUJI4 MINGW64 ~/Desktop/non collaborator repo
$ cd collab-test

Zibzą77@DESKTOP-DTPUJI4 MINGW64 ~/Desktop/non collaborator repo/collab-test (master)
$ git config user.name MichalNawrocki187

Zibzą77@DESKTOP-DTPUJI4 MINGW64 ~/Desktop/non collaborator repo/collab-test (master)
$ git config user.email michalnawrocki187@gmail.com

Zibzą77@DESKTOP-DTPUJI4 MINGW64 ~/Desktop/non collaborator repo/collab-test (master)
$ git add .

Zibzą77@DESKTOP-DTPUJI4 MINGW64 ~/Desktop/non collaborator repo/collab-test (master)
$ git commit -m"non-collaborator's commit"
[master 43bfc8d] non-collaborator's commit
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 non collaborator file.txt

Zibzą77@DESKTOP-DTPUJI4 MINGW64 ~/Desktop/non collaborator repo/collab-test (master)
$ git push origin master
Enumerating objects: 3, done.
Counting objects: 100% (3/3), done.
Delta compression using up to 16 threads
Compressing objects: 100% (2/2), done.
Writing objects: 100% (2/2), 276 bytes | 276.00 KiB/s, done.
Total 2 (delta 0), reused 0 (delta 0), pack-reused 0
To https://github.com/MichalNawrocki77/collab-test.git
   efc8dd2..43bfc8d  master -> master

Zibzą77@DESKTOP-DTPUJI4 MINGW64 ~/Desktop/non collaborator repo/collab-test (master)
$ 

and now MichalNawrocki187 is a contributor even tho he is not a collaborator, and worst of all he pushed changes without making pull requests

What you did is good (a public repo and managing the collaborators you want to provide push right).

It's just your test that is wrong because changing the user.name and user.email has nothing to do with the authentication (and push access right). It's just a display information used by git when you create commits (and yes these information are used by Github to distinguish collaborators of a repository and yes again you could set whatever dumb information you want).

Your credentials have surely been asked to you the first time you pushed to Github and stored by git in the credential manager and later automatically used when you pushed new commits.

Side note: you can't prevent pull requests because as long as your repository is public everybody could fork and working on its forked repository and do a pull request if he wants to help you. But it's not a big deal because in the end that's you that decide if you want to merge the PR and so include the commits. If you don't want, you just have to close the PR with a friendly comment explaining why you don't accept contribution.

Note: to do a real authentication test with another account, either do it from another computer or remove credentials from credential manager so that git ask them again...