What you want to do is only sort of possible. That data source CONNECT permission is the controller of this setting. You can deny users CONNECT, but still allow them to view the workbooks that use the published data source by asking the workbook publishers to choose "embed credentials" when they publish the workbook. That actually embeds the publisher's permission to connect into the workbook itself, but that's a lot of work for your publishers.
If the concern is more that users are creating these new workbooks and then saving them to the server, you can simply give them the Interactor site role. They'd still have the option to connect to the published data sources and play around in Web Edit mode with them, but they wouldn't be able to save their work.
Did you figure out how to accomplish this? I'm trying to achieve the same - Prevent users from creating 'New Workbooks' from Data Sources. (Reason: We have set up templates for our users and would like them to use those templates instead).