I'm afraid you will need to use javascript to disable those buttons, there is nothing to hook onto on the PHP side. That does not mean your enforcement mechanism can be circumvented. Sure they can cause the buttons to be enabled by disabling javascript. That allows them to inappropriately submit the form, but the server can easily disallow the submission regardless of what tricks they play on the browser side.
This still means you need your function to run. There is not a specific hook for the post list table screen in general, but you could hook 'admin_init' and check what the request is for. If it's not for pages you are concerned with, return without doing anything.
You will not only want your function to run on the post list table screen, but also for the new post edit form and the POST of the actual completed post form. These last two would not need to be checked for if javascript could not be disabled, but since it can...