Oliver,
If you don't have Output ES, then I think you'll have to do it via javascript in the form. For example, you could add a hidden checkbox to your form called "IsFormReadOnly" which has a value of 0 (false) or 1 (true). Set it to 0 by default. Then you could put some javascript code on the initialize event for the top-level form node in your hierarchy. This javascript would have to check the value of the hidden field to see if the form needs to be readOnly or not. If the value is set to 1, then you would have to set all of the fields in the form to readOnly (note that this can be done with a recursive function defined within a script object).
Now that the logic is in your form, you can then set the value of the hidden field from within your workflow.
I know it isn't the cleanest approach, but I think it may be your only alternative to purchasing Output ES.
Justin