I am unsure about the specifics of some of these options. However, I am highly confident about the fact that nobody can merge anything into your own repository without you doing it. They can submit PRs, but there is no way for them to merge and commit code in your repo because, well, it's yours. They can clone your repo and make all kinds of changes to it, but yours is the upstream, and you alone control it.
So regardless of settings, you can maintain a public repo, and only accept the changes you want. In fact, I suggest making a CONTRIBUTORS.md file that outlines how you want people to contribute, and you could create issues for those features which people could discuss, work on, and submit a PR for each specific case. That way you direct the flow of development.