I managed to do this with a constraint in the code. We haven't found any other way to do this yet.

The constraint basically checks if the user is in an allowed group to do the change that the drag and drop makes to the record.

File:  /web_kanban/static/src/js/kanban_view.js

Search the following content

var record_options = _.extend(this.record_options, {
     draggable: draggable,
 });

 Then add following code above that.

var models = ['project.task', 'project.project']; // add more models to be disabled
if(models.includes(this.dataset.model)){
     draggable = false 
}

This is working in odoo 10th version.

To Disable Drag and Drop of Kanban View  records we need to modify at web_kanban module.

Path : web_kanban/static/src/js

File : kanban_view.js

Modification : Search for the below code

Did anyone find a solution for only allowing users in an allowed group to do the change that the drag and drop makes to the record. We would like to put restrictions on users shifting tasks into the task stage "done". Only certain users should be allowed to do that.

For disable drag&drop on entire kanban use:

<kanban edit="false"  ...

For enable drag&drop on specific card use:

<t t-name="kanban-box"> 
     <t t-if="record.state.raw_value=='draft'"> 
         <t t-set="dragdrop" t-value="'oe_kanban_draghandle'"/> 
     </t> 
     <t t-if="record.state.raw_value!='draft'"> 
         <t t-set="dragdrop" t-value="''"/> 
     </t> 
     <div t-attf-class="oe_kanban_card oe_kanban_global_click #{dragdrop}">
  
...