That is what I mean.
Of course you should keep backups.

The read-only is only needed if your people are accessing the templates directly from the network.

Again, my preference is to have both Global Templates and Workgroup Templates stored in a network location and copied to individual computers updating as a part of the login process. That way these resources are available regardless of the network connection and the user does not have access to the base template. I have not worked with networks for a long time. When I did, we used an XCOPY statement in the login script.

Just train your people that if they want to have their own versions, they need to store them in their own templates, not in the corporate ones. (Once or twice losing them due to overwrite will burn the training in!)