Security for REST API Endpoints Methods

Summary:

Restrict user access having REST API Access to execute 'GET' method but not 'PATCH' or 'POST'

Content (required):

We have a requirement to share the REST API Endpoints with Third-party users to get the Candidate and Job Application data from ORC. But we want to ensure that the user should not be able to run the 'PATCH' or 'POST' to update or add details for the same.

Is there a Duty Role or Security Profile that can ensure the same?

Version (include the version you are using, if applicable):

Code Snippet (add any code snippets that support your topic, if applicable):