I had this issue with our phone support techs in that they would sometimes change something in a router or switch in an attempt to help their customer (without permission of course). I put a Read Only Tech account in every MT on our network then I made a second Dude server with different credentials that logs into that Read Only account, and BAM, Read Only Mikrotiks in Dude. My Techs can still log in and look around but cannot change ANYTHING. You could also just deny any Winbox access at all to that user group under “System>Users>Groups”.
We have about 400 MT devices so I made a small script to help with deployment of the additional account and then added it to my pre-deployment script.