There are two privileges that manage the privileges to work with Custom Attributes.
They are
Global.ManageCustomFields add,remove and rename custom attributes
Global.SetCustomField set the value of a custom attribute
You could try to create a new Role that has only the Global.SetCustomField privilege (besides the other required privileges), but not the Global.ManageCustomFields privilege.