ACLs are not based on the functionality, rather its based on the jcr operations. So you can control only at CRUD operations of the jcr nodes. So in your case for annotating on the page, you need to do write operation on jcr and hence you would need to have 'modify' enabled on the site.