Only allow certain roles to publish content, other roles can save as unpublished?
You will need to alter insert / update node entity form: 


Define a permission "Save unpublished content"
Make a hook_form_alter or hook_form_ENTITY_TYPE_form_alter
Check if you are alter the exact entity types you need.
Hide all buttons you don't need (based on permission)
Add button ('save unpublished content') (based on persmission)
When submitting: call the default submission and add yours to set the status 0. 


Save button is an UL with two LI elements: save published, save unpublished: