Hosting an existing (local - mercurial) repository with Phabricator

It's not "hosted by Phabricator" if people have external access to it, it's just an external repository that happens to be local on disk.

So in order to have just a single copy that Phabricator manages, I'd need to prevent other users (e.g. via ssh) being able to commit to it outside of Diffusion (e.g. via "hg push ssh://server//home/hg/myproject")?

The point to having Phabricator manage is setting up real permissions (ie, no commits that aren't reviewed). If you still gave say an admin or two direct access to the repo, I can't think of anything that would go wrong or bad, just that you lose those abilities.

Are you switching from direct access to wanting to have everyone go through Phabricator?

Yup - that's the plan in the longer term, but I don't yet have buy-in to make such a major change. So, I'm hoping to set up Diffusion as just a repository browser to replace the hgweb interface which has several shortcomings.
If I can show people how great Phabricator is, then in future I hope to move users over from accessing repositories directly and managing permissions through a combination of unix groups and ACLs, to having everything done through Phabricator. But since we have over 100 repositories, I'm hoping that I won't need to duplicate them but can instead set the default repository path to that of the official location on disk and have Phabricator just import the changesets.