Did you check the following solution?

Extending Create roles for current variable:

On the variable form if not already visible add the fields Create roles and Write roles. Add specific role to it and the HTML field will be appear read only and the toolbar will not be visible for all users that don't have this role.