Multi-Record Custom Data Set - Permissions (View/Edit)
Probably not the answer you were hoping for :-(, but confirming that is a current limitation.  ACL's for custom data do not distinguish between View &amp; Edit.  On the New ACL screen, when you set the type of data to custom data, a message is shown:  


  NOTE: For Custom Data ACLs, the 'View' and 'Edit' operations
  currently do the same thing. Either option grants the right to view
  AND / OR edit custom data fields (in all groups, or in a specific
  custom data group). Neither option grants access to administration of
  custom data fields.


It would be a useful enhancement to fix that, but you can't do what you want without writing code.

If you just want to deter some people from changing the data then adding a bit of jQuery to disable options would be fairly simple. That is not secure since a user can bypass it.

For a more robust approach, you could try hook_civicrm_validateForm.