Perhaps an easier way to do this would be to disable specific permissions on the workbooks and let Tableau Server handle the security: Set Permissions for Workbooks and Views. Following that path, you can deny users the ability to download the workbook and underlying data, while still being able to export the PDF/Image/Summarized Data.
Hope this helps!
Santiago is correct that enabling View Underlying Data but disabling download could work.
Or, if you want them to be able to download the workbook but not the tde, then you could publish the tde, point the workbook at the "Data Server Datasource" instead of the tde. Then they could download the workbook but not the tde.