Restrict writing to AD attributes
Solution 1:
Permissions are per-attribute, so you can add an inheritable permission at the root of the domain (or OU) that applies to all user objects to deny write to those attributes.
Deny always takes precedence over Allow, so it should work.
Solution 2:
As long as someone has full control of the object (or is a Domain Admin), they are going to ultimately be able to edit these attribute values, as well as do anything else. It seems like there is a process/trust issue here more than a technical issue that you need to solve for.