ESS and securing Databrowser

I am just wondering what other clients do for security when they allow non HCM users Databrowser access, but also lock down HCM tables.  Because the ESSUSER Role needs access to  allow an employee to see their data in the ESS programs and when making changes up date to the ESS Tables (F054101W, F085530W, F085537W, F085536W, F085520W) how do you allow an employee to use Databrowser in E1 for non HCM tables and lock down all HCM tables, but still have the ESS process write the updates to the appropriate table?

This client is on E1 9.1 tools release 9.1.5