I've created a group which has permision to use the CRM and sales modules, I want them to be able to see the quotations assigned to their CRM clients (which I already did it) but I want them to be able to put notes, comments and attach files to it while not being able to edit it. 

Now I have the permissions set like this:(I can't upload images, it's sales.order with only the box "read access" checked.

In this way they can see the quotation and they can't edit it. But this prevents them from writing notes. Which object/parameter should I use to give them permission to do this? 

Thanks