Is it possible to limit access to field through ACL or drupal permissions?
One option with Drupal for this sort of scenario is to actually keep your 'read only' users completely out of CiviCRM and deliver whatever they might need through Drupal Views, and if necessary, Webforms (for making updates to data)