Question about using forked repos and merge from origin

Hi everyone!

I’d like to use git with GitLab for configuration management (for servers). For this, we will have a “master” repository which will contain a template. If a user requests a server, the master repository will be forked for this user.

The forked repository, which is linked to the user’s server installation, will have a protected master branch. If the user wants his configuration to be changed, he has to create a branch, change the configuration and then file a merge request with the admins in GitLab. They will eventually merge the changes into master and then apply the new config to the servers.

I want users to be able to apply changes in the template to their (forked) repository. Now here’s the thing I couldn’t wrap my head around:
If the original template repository becomes updated, the recent state would be in the master branch. In order to apply this to their local repo, users would have to merge the changes from the template/master to their own master. However, they aren’t allowed to push to the remote.

One possible solution would be to locally apply the template changes, then branch and then submit a merge request for merging this branch into the remote master.

Is this the proper workflow to do this?

Thanks in advance!