PRServ is currently setup to be read-writable all the time. If you expose e.g. release artifacts, you will want to expose a PRServ in read-only mode to your users. This could just be a end <IP>:<PORT> the daemon binds to but w/o actually accepting new data.
Current short term workaround is to distribute the PRServ data to your customers from a read-only location. (Doesn't really solve the read/write problem..). But keeps them from using your own resources accidentally. Eventually I would like to create a combined PR Service, hash equivalence, sstate server that would manage the components together and permit features like read-only, etc. (This more complex would likely be external of the current bitbake mechanism, as it's potentially a lot more complex!)
In the last release. https://git.openembedded.org/bitbake/commit/?h=1.52&id=44287430b9804fcbf2440f85a2424792140e4dc9