This is what Medium's policy page says:
Medium writers are welcome to promote themselves and their products/services in their writer bio. The story page is for the story. Any calls to action (CTAs) in the story should be simple, clear, and brief (under 40 words or so), including for publications. Embeds that collect user information must do it off-site only (collecting user info on Medium is a rules violation). Your CTA may include a limited number of hyperlinks to other content. Intrusive or deceptive CTAs or promotions may cause your story to be rejected.
The part above in bold is why we've been able to stay compliant. Upscribe forms actually take users to a separate website (off-site) before saving their email addresses, etc.
Additionally, here is a tweet from Medium Support confirming that they allow Upscribe embeds:
You are certainly allowed to embed forms on your posts and still qualify for distribution!