Hi Nick, You can place fields that you want to make read only into a section on the custom form that defines the level of permission necessary to make changes to those fields.
Also, sharing settings can limit users ability to make changes to custom forms, the entire form. If you share a form with the group and the user isn't part of the group, they will see the form (if it's already associated with the object) but will not be able edit it nor to add it to a different object. Hope this helps, Teale Teale McCleaf Google Inc.
