Locking users out

Our HR staff insist on signing staff on for the current month after the input period has closed.  This causes huge problems with control issues. They have different responsibilities to the Payroll users.  Is there any way that I can convert their responsibilities to view only while we run the month end?  Or lock out their update responsibilities and make them  use view only responsibilities.  They would need to be able to capture future dated stuff, just not for the current pay period.

Any suggestions welcome.

Thanks