limit set of parts read only

Not directly, you can set all of the parts to be read only for a given permission or all of them to be updateable, but you can’t restrict a sub-group directly using just permissions.

If you want to do that, you would need to use another field to tag the items to be forced read only then use a separate function to block the save of any changes to those items if the user is allowed to modify those tagged items.  The downside to that is, if they can modify the tagged field, they can remove the block if they know how it works.

You can get to what you want to achieve, but not directly with any of the permission settings, only with custom events, a custom field or tag in an existing field, a list of users against the user or some basic data table and a function to validate who is and isn’t allow to edit those records.