Enterprise geodatabase users cannot be truly "read-only" because the possibility exists
that they will need to write to logfiles (which are used for large selection sets). You could
export the dataset to a file geodatabase, and set permissions appropriately, or you can
simply not grant the user UPDATE/INSERT/DELETE on all tables (allowing them to make
tables which would not matter, but no more).
- V