How to make a user not being able to publish his content?
How about [implementing hook_node_presave($node)][1] in your custom module,so as example code consider the following

function mymodulename_node_presave($node) {
  global $user;
  // check if user has role and checking node-&gt;original is not set ensures it works only when insertion of node happens not when it is edited
  if (in_array("your_user_role",$user-&gt;roles) &amp;&amp; (!isset($node-&gt;original))) {
    // keep the node unpublished
    $node-&gt;status = 0;
  }
}