I think it is better to place this limit in the database rather than in the application. Create an individual user in a live database that is a member of the data_reader role. This will give read access only to the database.
If you changed the security settings and roles on the server, you will need to check in more detail, but by default there will be data_reader .
Edit
An easy way to do this is to override the SaveChanges() method of the data context for these databases:
public override int SaveChanges() { throw new AccessViolationException( "Don't mess with a live database during test"); }
source share