"I'd like to limit some users to read-only access to my workspace. Can I do that?"
You can use MediaBoxes to allow for selected content to be accessed from the Workspace to whomever you choose to have that access. With Secure, Protected and Public MediaBox links, you can control the access with those variations that allow you to manage the MediaBox and the content being shared.
In addition to MediaBoxes, Ci provides functionality to reduce administration: just set up your workspaces, invite your team members so they have access to the files they need, and let them get to work. The idea is that you invite only the team members you need to work on your projects. If you have different access requirements for different projects, just set up separate workspaces for each project. For more information about structuring workspaces, please see Structuring Workspaces.
When you invite team members to a workspace, you can choose whether they can add/remove members or permanently delete files. For more information, please see Inviting Users to Workspaces.