You could proxy using nginx to allow read only access to specific endpoints, there's a few good posts about it going into better detail than me, for example:

http://blog.eagerelk.com/securing-elasticsearch-using-nginx-...