This should be possibly to do with ssh keys. Unfortunately, I have no idea exactly what you'd need to put after the key, you'd need to find out what
hg push does when you do the push. For example, with rsync, you can do something like:
command="rsync --server -vlogDtpre.iL . /path/to/dir/",no-pty,no-agent-forwarding,no-port-forwarding ssh-dss Adslkjhdfslw.......rest_of_key
Put the above in .ssh/authorized_keys2 and then see if you can figure out what command hg push is running and put it in the command field.
It's possible that hg push is only doing an scp, in which case the scponly shell might also do the job.
Hopefully this will point you in the right direction.