You need to set the access control list of the product.template and product.product. You can find it in the settings >> technical >> security >> access control list. In the ACL you can set the product.product and product.template permissions to read for all but the admin group, and set the objects' permissions to create, delete and update for the admin group.