you can set "normal" entities read-only in an espace so you can control the consistency of the data in the espace itself (expose them with actions etc.)
however, you cannot do the same thing with external-xif-entities.
what I like to see you could achieve the same as with "normal" entities.
set them read-only and create actions to CUD them in a designated espace.
Perhaps you can assign a designated espace to it which is allowed to do anything.
and the other espaces only can read those entities in queries.
hope I made myself a bit clear :)