Is it possible, using ACLs, for a group to have only 'create' access to contact custom data and another group to have 'edit'?
One way of doing this, if you were using Drupal, would be to use Views and Webforms. This is our 'go to' approach when needing to finesse who can see/do what.
I would use Contextual Filters to show the logged in users the data they should be able to access, and then use links to take that Contact ID over in to a webform_civicrm form for doing any editing.