One can only obtain native CAD files outside Windchill via a workspace using a CAD Tool (e.g. Creo or SolidWorks), so granting only Read and Download to EPMDocument Type gives the group what you are requesting in general.
Just have to prevent use of workspace in CAD for these users. One way is to not grant Modify to the Cabinet object type for the Product / Library.
note: Beware of permissions to the Teammembers pseudo group which includes all Roles other than Manager and Guest.
Yes, if you mean the part is a CAD model, you can consider:
Deny download authority of EPMDocument (OR CADDocument) type in Windchill policy administration utility of the group -- which not allow the user to open the part in a CAD tool
Grant Read & Download authority of Derived Image (including stp, representation in Creo View) type in Windchill policy administration utility of the group -- which allow the user to open the representation of the part in Creo View (or download the stp)