Hi @JamesMa43,
So, in AEM as a Cloud Service (AEMaaCS) Assets, you can’t directly deny download using permissions.You can allow users to view/read assets easily by giving them jcr:read, but there’s no separate "deny download" button out of the box.
May be you can use metadata and download profile tr...