How do I properly configure a bare repository for git fetch?

Question

(This question builds on How do I update my bare repo? and git fetch doesn't fetch all branches.)

I've cloned a bare repository from GitHub, the idea being that:

• Developers use GitHub, and push to Github.
• On the server, the above-mentioned bare repo fetches from GitHub (say, /var/repo/my_repo)
• The bare repo is cloned to one or more "document root" locations for web serving to facilitate various checkouts of the codebase. So, /var/www/my_repo_live and /var/www/my_repo_dev are both non-bare clones of /var/repo/my_repo but have different branches or tags checked out for serving.

I seem to have run into some complexities—from the git clone manpage:

• When --bare is used, "the branch heads at the remote are copied directly to corresponding local branch heads, without mapping them to refs/remotes/origin/."
• "Neither remote-tracking branches nor the related configuration variables are created."

This makes sense: since you're not going to do editing in a bare repository, you don't need to separate remote tracking from local tracking branches. But, then:

• How are you supposed to fetch?
• Given that remote branch heads are copied directly to the corresponding local branch heads, how do you set up your remote.$remote_name.fetch refspec? Should it just be fetch = +refs/heads/*:refs/heads/*?

P.S. I am separating /var/repo/my_repo from the document root repos for permission reasons. I don't want publicly-facing, www-data processes to have access to the repository that's linked to GitHub. Is this overkill? Regardless of whether it's overkill, I would still like to know to properly manage fetching with a bare repo.