You can use gerrit in front of gitlab via the replication feature. The replication feature does not do a git clone/fetch, it only pushs (approved) changes to a remote repository.
- you have to import repositories via e.g. 'git push origin master' which requires extra permissions (or you need to be the admin). That is not a big deal unless you forget to remove these
permissions. If you forget to remove these permissions or are
administrator (who has these permissions): a default "git push" will
make it through without being reviewed.
- you have to make sure that no one can commit to the gitlab instance.
Else you have a high chance to run into merge conflicts (gerrit is
not aware of these new commits). You can protect the branches in
gitlab -- but the admins (and if I remember correct also the
repository creator/owner) will always have this right, too.
- You have to grant a gerrit user master permissions to allow it push to the gitlab repository.
- All projects have to be first created in gitlab, else they will not be synchronized (unless you find a way that the repo will be automatically created in gitlab on the first git push)