Hi Richard,
You can use authorization object C_SHES_TRH with field (ACTVT - Activity) equals to 03 (display all specifications but not create or change any) to restrict users for display only purpose in CG02.
You can also check authorization objects C_SHES* for other restrictions in Specification Management.
You can check object documentation for more details.
Regards,
Kannan Veerapandian.