Solved
AEM 6.3 package permissions: allowing a user group to download, build a package, but not install
Is there a way to prevent an AEM author group from being able to INSTALL packages?
They should be able to download them, or build, but not INSTALL.