Disable all write requests momentarily for DB migration in Firestore security rules

Question

I have a project that I need to restructure its Firestore DB. Currently, it's in daily use, so I need to disable all write (& maybe read) access for users only (not admin) until I can fully migrate the DB & make sure it's flawless. My intuition was, that I could simply add a recursive statement to deny all incoming write requests. But it turns out that Firestore ORs overlapping match statements.

match /{document=**} {
  allow write:if false 
}
// More match statements for Admins & Users. 

• What's the right approach here?
• Curious of the design decision behind ORing overlapping matches. Anding here would make more sense since it's more strict & leaves less room for un-intentional data leaks.