GitLab EE/CE 8.11 up to and including 12.9.1 allows blocked users to pull/push docker images.
gitlab gitlab