Hi,
Are you saying, you will configure RO but not RW?
That should be fine.
The only thing I can think of that you need RW for is end to end and phone status testing.
If you have dedicated shadow routers for these purposes then you can just config RW on those devices, and leave the rest RO.
Cheers,
Tim.