Create a custom TFS user and grant/deny permissions on it - visual-studio

Question

First a brief explanation about who we are and how we work. We are a small team and we work together with a consultancy in our own project. We work with a main branch and then we create development branches from it each time we need to implement a new feature. When that feature is implemented we merge main branch into development branch and we test it. Once tests are ok, we finally merge development branch into main branch and we test again. If all test are passed in main branch, then we deploy/publish it to production.
Now what we are trying to do is to create a user for consultancy in our TFS system in order to this user can/cannot do following things:
Consultancy cannot create branches from main branch (summarizing they cannot create branches in TFS repository). We will create development branches for them and we will grant permissions for them over each development branch created.
Allow consultancy to get latest versions from development branch and map it into their local computer.
Allow consultancy to work in the development branch by using check-ins and check-outs. Consultancy can do all operations in development branch except merge it into main branch.
Allow consultancy to merge main branch into development branch but not vice versa.
The goal of this is to keep our TFS repository under control.
So how can we create a user in TFS following above rules? Note that each time we create a development branch for consultancy we must grant/deny the corresponding permissions on this user.

Answer 1

You can add Windows user or Windows group in TFS. TFS use the authentication with windows user/ domain user(Active Directory) to access the server. TFS can't create users directly. There are no TFS own users.
Additional: About the relationship with TFS and Active Directory
TFS does not write to Active Directory (AD) nor "has it's own
Active Directory".
TFS stores users and groups, permissions and security, into its own
database. To integrate with Windows Security by running a background
job
every hour and reading users and groups from AD.
You may have to add that user in your AD, and give him access to TFS, finally assign them corresponding permission for each branch, Main & Dev.
To manage branch permission , you could either choose
In Web Portal--Project Settings--Repositories--Branch
In Visual Studio--Right Click--Advanced--Security
For each branch's permission setting, you could directly manage that user's or create a group then add that consultancy in the group, manage the group's permission.
Check in
Check out/Pend a change in server workspace
Manage branch: Users cannot create branches from a branch for which
they do not have the Manage Branch permission.
Merge: Can merge changes into this path.
More details about the description of each permission please take at a look our official tutorial here--TFVC (object-level)