In Embedded model we don't put Actuals and Plan data into same cube. We use MultiProvider of 2 cubes instead. Only data from Plan cube can be changed. Since Actual data will come from basic cube users won't be able to change it.
Si, there is no need to make it read-only.