Azure Container Registry security

Your organization is migrating container images from a public registry to Azure Container Registry to improve security and control. The security team requires that only authorized users can push new images or pull existing ones. Which Azure Container Registry feature provides this level of access control?