How to restrict transaction PE03 (HR: Features) to display only mode?

We have a situation where a set of users need access to transaction PE03 to display HR Features. However they should not be changing any feature through it.

The only auth objects that are checked for this transaction seem to be s_tcode and p_tcode. As both this objects are checked during transaction start, there does not seem to be any check for display/change access.

Appreciate any inputs.....Thanks!