Hallo Paolo,
Yes, I use the features within Package Control.
I just have one root and two “EA-views” underneath, so what you have mentions is not a problem for my. If so, I would thing about to solve that problem with a script.
Another possibility I have in mind, is defining an “edit group” and assigning it to any user who is allowed to update some stuff, so I could just disable the update stuff in this group.
Both approaches I have not jet tested to be reliable, so there might be problems that these changes are only active when users reload the project or even restart EA, or maybe the script engine is ignored in those security features,….
Currently your “brute force” way, I could do as well. But the day will come when my IT will disallow me such “critical” things.
Another way I have in mind, is providing only Cloud Service access to the users. By doing so, I could lock out users by the Cloud Service (setting passwords, stop cloud server, …). Another advantage of that would be, that I would not need to give users write access to the DB. This would work fine I assume, if all EA features could be used over the cloud service.