How do you lock HR down to not edit own record?

Summary

HR Users should be able to see their own record, but NOT be able to edit and make changes to own record!

Content

Originally, when Manage Person Profiles was set-up, it was set that View Own Record was not checked off/enabled.  This prevented the HR user from seeing his/her own record and they would also not show up on reports and be dropped off when running them.  I went back in to Manage Person Profiles and selected the security the HR person is in and selected to View Own Record.   The HR person can now see their own record which is good, but now they can also give themselves a raise, promotion, change other HR data they should not be allowed to do