A new right object on the role level would be very helpful, that gives you the option to allow user only to write into the database when using the web and not the Excel Add In. This way you could give a user only read-rights for the Excel Add In a...