Restrict rsync over ssh read only / only copy from remote host
Solution 1:
The -ro flag of rrsync ensures that rsync is called with the --sender option, which should, according to the rrsync documentation, ensure that files can only be read - however, I could not find a authoritive source (aka rsync documentation) which confirms that. In my tests, it was sufficient to prevent writes to the server.
Solution 2:
Have a look at authprogs - I was using it for a quite similar scenario (backuppc via ssh)