Currently, there really is no way to do that. There are some “hacks” to set entities displayed in the UI to read-only (using simple-entity), but those can be overridden pretty easily.
There is an ongoing discussion/feature request though: WTH2 - WTH!? No RBAC - Role Based Access Control? (Users & Groups rights)