Limiting Individual Users Rights

Is there a way to restrict the some of the rights of individual users in the On-Premise version of VO?

For example, I want the user to have complete access to the group tools except the ability to change and upload documents and the ability to post announcements. I still want them to be able to download and view the documents and announcements, just not alter them in any way.