Will this work?

1.In the DSR remove all users, and remove the default checkmark from the box that allows everyone to redesign.  Reconcile to the DB.  DO NOT SAVE the DSR yet.

Now, change the DSR security.  Add the desired security into the DESIGNER, only need one name, YOU, with permissions to change design.  Now, whenever you reconcile DSR to DB, make sure that NO is selected on the option to update the DB security.  This will allow no DB users to redesign, and there are no names/groups set up.  But the DSR file will only allow YOU to do redesigns.  Now you can save the DSR.  Make a backup copy.

Only potential problem I see, is that if you need to make a new DSR from the DB, YOU will also be locked out.  So you will first need to reconcile the designer allowed DSR to the DB, selecting YES to modify the security in the DB.  Then open the DB and make the new DSR from that, and go back and repeat the steps above, from Step1, removing all users, removing the checkmark. etc.

This is untested, just an initial reaction to the question.

There's another easier way to prevent users re-designing. You can use @HideTreeItem to disable the Application menu. Further, you can remove on their workstations the sdesigner.exe file, and the shortcuts to Designer from the desktop and the start menu. That way they simply can't redesign the application and all paths to Designer are shut off. Without using security.

This is of course not ultimately secure. If a malicious person were to copy the application to another PC with a full Sesame install on it then it will be completely open. To avoid that you do need to employ security.