Address Book Action Code Security based on AB Type

I would like to know if any other organizations have implemented processes to restrict Add/Change/Delete activity in Address Book based off AB Type?

We have a need to restrict Add/Change/Delete on certain AB Types to just Inquiry, based on security roles, so only designated roles can perform Add/Change/Delete to those same AB Types.

(Example - A/P Vendors should be inquiry only to all security roles except those responsible for setup and maintenance of A/P Vendors.   Same with Employees and Dependants, Tenants, A/R Customers, etc).

What do you feel works best, how have you implemented, is it easy to maintain through updates and version upgrades, how does it work with Add-On 3rd party Security tool, etc.