That functionality depends on how people are accessing your repository, which could be:
- local file access
- ssh network access
- http access via built-in
hg serve
- http access via external web-server
You can see pluses and minuses along with instructions for each on the PublishingRepositories wiki page.
Per-user access controls are available in options 1,2, and 4 above. With options 1 (file) and 2 (ssh) you'll be counting on your operating system's built in user controls. With option 2 (ssh) you could also mix in the shared ssh techniques for additional access controls. With option 4 (external http server) the sky is the limit. Authentication comes from the HTTP layer (e.g: apache) and mercurial uses that info along with the allow_push
settings to grant access.
In cases 1, 2, or 4 you can also mix in the ACL extension for even more fine grained control.
Bottom-line: totally doable and commonly done, but you've got some decisions to make about how depending on how public your repo is and where you want to be controlling credentials.