The security on the created Event Frames is controlled by the template's ReadData and WriteData security settings. For your use case, you would configure the template's security for the identity to NOT have Write permission and to have both ReadData and WriteData permissions.
The documentation in the AF SDK's help for AFSecurity class has more information: https://techsupport.osisoft.com/Documentation/PI-AF-SDK/html/T_OSIsoft_AF_AFSecurity.htm