In order to publish content a user must have the Site role of Publisher.
Within the Project you can set the Save and/or Download Workbook/Save As permissions to Deny or just leave it blank. You could also deny them Web Edit permission. There's no level-dependent demoting (Project, Workbook, View) in Tableau Server.
Remember, it's typically best to leave a permission rule blank, setting it to Deny only if necessary after testing.