How do I grant read only access to one stream in the project area?

 I would do this using teams.

For example, let's say in your case you have 3 streams. As you mention, one should be read only to a given set of users and the other two should be read/write, call them Read Only Stream, Write 1 Stream and Write 2 Stream. 

First thing would be to create two teams: Team A and Team B. Make Team A the owner of Read Only Stream. Make Team B the owner of Write 1 Stream and Write 2 Stream. Then, add your team members to the appropriate teams with the appropriate roles. 

Let's say in your example you have Ming, Steve and Judith as your team members and Ming is the lead with write access to everything, and Steve and Judith should be prevented from delivering to Read Only Stream. Then, add Ming to Team A and Team B with a Developer role (or some role with deliver permissions). Then, add Steve and Judith to Team A with a Stakeholder role (or some role with NO permission to deliver) and to Team B with a developer role.

You will have to modify the team members roles at the project level as well, I believe, so that they don't override what you have specified at the team level.