You can protect MASTER in VSTS pretty easily as TFS provides enterprise Git capabilities. There are two ways to achieve this.
1) Git Branch Permissions
In the administration pages under the Version Control tab you can change permission for each published branch. You need to maintain access at the repo level, however on MASTER you can change "Contributor" commit permission to "not configured". You can then add only Rob...
Oh... Always use "not set" rather than "deny" as deny always overrides.
2) Git Branch Policies
VSTS has introduces the idea of Branch Policies. These Branch Policies can be applied to any branch but are traditionally applied to MASTER.
Here you can apply multiple policies to reflect you needs... I always set