Question: How can I set up a central Mercurial repository on a Windows server which only allows push and pull access to certain users?
This situation is fairly well documented. Check out the “Collaborating with other people” section of the very useful HG Book.
In short, you can configure ssh access to the Mercurial repository, and limit access to specific users.
Some more reference guides: