Deny INSERT/UPDATE/DELETE to a particular schema
Usually you just put the users in an AD group and add the group to SQL as a named user.

Then grant the named user select/execute privileges by schema.

This is how you grant/revoke privileges.

Let's say we have a user abc and he uses schema xyz. Here is the syntax.

GRANT Insert ON xyz TO abc;


Replace 'GRANT' with 'Revoke' and 'Insert' with ('Update' or 'Delete') according to user requirements.

You can revoke all of three at once together too.

Revoke INSERT, UPDATE, DELETE ON xyz TO abc;