SFTP - whitelisting requests for read-only access
Solution 1:
Oh, I just found the - apparently - best solution: The parameter -R sets the whole session into read-only mode.
Match User my-read-user
ChrootDirectory /sftp/%u
ForceCommand internal-sftp -R