Hello Steve, 

Thank you for taking the time to reply. I've verified what you said above is true. Prior to this post I had removed all entitlements from the default user group. The Consumer Access entitlement is the only entitlement the target group has enabled. I ended up setting up a test account in a non-production environment and accessing every area of the Workspace that my admin account could access. At no point could I change data in the Workspace. The exec who brought this issue to my attention was briefed and is content knowing data cannot be changed.