I do think we can actually just allow queries and block mutations, by making the endpoint aware that we don't want to use mutations.

This requires more thinking and testing than just my sentence above. I know that we can do stuff to the GraphQL middleware. If you don't mind the wait, I'll explore more about it in the coming days ^^