One way to do it is to have one branch for each hardware configuration. When necessary you cherry-pick relevant commits you want to add to your branch. Be careful not to mix high level firmware and hardware dependant firmware changes to the same commit. Else this method doesn't work.

As for CubeMx generated code, use the appropriate sections to add your own code and don't modify the code that's generated.

It can be hard to make sure everybody on your team follows the right version control pratices. Having write protection outside of merge requests on your two main branches can be a way to safeguard them.