There is one product provided by Secude AG, that intercepts downloads and secures them using Microsoft's Azure, or AD RMS. This is the only way I know of making sure the downloaded files are readonly.
There may be other products that do the same thing.