You need the sticky bit, similar to
/tmp that has mode
1777. Setting this bit means that only the owner can rename or remove file.
For the permissions on the files, you must make sure that the group permissions are read only.
If you don't want to modify the users' umask, the use
setfacl on the directory with the
All operations apply to the Default ACL.
In addition, a directory may have an associated ACL that governs the initial access ACL for objects created within that directory; this ACL is referred to as a default ACL.
The default ACL specifies what ACL (access permissions) should be applied to new files and directories within the specified directory.