You need to use a file system filter driver in order to deny writing or deletion. You can write your own (6-9 man-months of work to get it right), or you can use our CallbackFilter product, which lets you complete your task in about an hour.
Remember, that the OS doesn't have "file copy" operation. File copying is a sequence of file open/file read/file write/file close operations.
