And don't forget transactions line ME23N that start as display transactions but can switch to change mode without needing access to transaction ME22N. You do still need change authorisation, but you can make changes from the display transaction.
If I had to do this, I'd do both. Change the authorisations and lock the transactions. Belt and braces. Less likely that something will slip through.
May I ask, what's the point of keeping the read-only system? Just for reference? It isn't a continuously updated read-only, but rather a frozen copy. Is that right? How important is it that the system doesn't change at all?
If I was really paranoid, if it really mattered that this system existed and couldn't be changed, I'd do the above, and also build in a nightly restore from backup (or equivalent) to wipe out any changes that slipped through anyway. With modern storage systems rolling back a system takes all of a few minutes if it is done right., and can be automated. Ask your Basis people!
Steve.