Update so far:
For the first issue (FM Go allowing me to edit container fields that had been marked to notbe editable by browse mode): I realized I had not set tab orders on my layouts. Once I set tab orders and omitted any of my graphic container fields, that part works much better and it keeps me from editing those fields.
Still an issue: I'd ideally like to have the user's account not able to edit layouts, scripts, and schema, however in making this restricted account I have managerd to lock the ability to edit the container field with a signature. Adding a signature is more important that limiting access, so for no I'll just give the account "Full Access", but if anyone knows what setting I must leave open for the "get Signature" to work, I'd still be interested in the info.