You have to use Access Rights using the csv access privileges definition file. This can be achieved as follows:
Define your model
Define security groups, one of them should have read only access rights, and be the parent for all other groups, and its first child a group with Read/Write, with no create access right.
You define the groups in xml file like :
<record id="group_read_only" model="res.groups">
<field name="name">Group Read Only</field>
<field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
</record>
<record id="group_read_write" model="res.groups">
<field name="name">Group Read/Write</field>
<field name="implied_ids" eval="[(4, ref('group_read_only'))]"/>
</record>
<record id="group_read_create" model="res.groups">
<field name="name">Group Read/Create</field>
<field name="implied_ids" eval="[(4, ref('group_read_only'))]"/>
</record>
Now defining the csv file, you have to name it "ir.model.access.csv"
Suppose that you have a model called "my_model", and your module is "my_module"
id name model_id:id group_id:id perm_read perm_write perm_create perm_unlink
access_my_model_read my.model model_my_model my_module.group_read_only 1 0 0 0
access_my_model_write my.model model_my_model my_module.group_read_write 1 1 0 0
access_my_model_create my.model model_my_model my_module.group_read_create 1 0 1 0
both files should be included in the __openerp__.py definition file
Now you can create users and the user you don't want him create records, then grant him write access only, then the 'Create' button won't be shown for him.
This is a concise description, you can refer to one of the standard modules in the addons folder like 'sale' module and imitate the patterns there.
I also didn't mention the 'delete' access right, it would be done the same way as 'create' & 'write', using the 'unlink' column in the csv file.