Sounds like you want to change the OTHERS level access, and possibly GROUP level access.
Basically, set all access to "-" for OTHERS, and only grant read access to GROUP.
Something like this?
RWX,R--,---
If there are files that the system needs to access, but you dont want to run daemons as root (because you arent dumb), then GROUP comes to the rescue.
Create a new group, and name it something like DAEMONS or something. Give the limited user accounts used by the system daemons that need access to those files membership in that group, then change ownership of the files, by doing recursive chown at the top of the drive like this:
chown -R [owner]:DAEMONS *
This makes the ownership information grant permissions to the DAEMONS group, which then lets you dole out that readonly you need, while keeping actual ownership at the USER level intact. This lets your own user still have full access (root always has access), and gives provisions to the DEAMONS group for read only access, which we then set up with chmod at the top of that drive:
chmod -R g=r,o= *
That should leave any permissions set for your user level access alone, and set read only for group, and no access for others, and do it recursively. Afterwards, your user should still be able to see and use their files, only members of the DAEMONS group can get special group level access which restricts them to read only, and people not in the daemons group wont even be able to list files there. (they CAN change directory to there at the command prompt, but doing anything there will give an access denied message.)
The last bit of the puzzle is the default file creation mask in ~/.bashrc
We want all newly created files for your user to automatically assign group and others the correct permissions at time of creation (so we dont have to keep doing the above all the time to fix them) We do that with the umask. At the bottom of the .bashrc file, (or /etc/profile file), change/append this:
umask 037
That usmask gives the current user full permissions, the group permission of read only, and denies all permissions for other.
See this handy reference for how to calculate umasks