You can only change the mapped role using the CLI not add a extra data permission to the VDB, that must be done in the VDB definition.

So, add a data permission in your VDB that restricts the insert/update/delete and only give permission to specific users with some role. The use "mapped-role" concept to map that role to user's group from yur enterprise LDAP or whatever the authentication mechanism you are using.