Each developer must have their own clone repository. Thus, they can branch out and tag, as well as whatever they want, and have a backup at a remote location.
When a developer modifies QA'ed and is approved for publication, they must be merged into a master repository , even if they are in a different branch.
Thus, you have a local / remote copy of all your changes in all branches, but only completed / approved changes make it to the production repo, since this is a merge, the entire commit history is included and you get a good workflow.
Arena source share