Adjust contributor capabilities to write, publish, but not edit

My searches have come up with some responses, but I’m at a loss how to implement this.

I’d like the contributor to be able to publish their post, but not be able to edit ANY post. This is for security purposes.

Alternately, I could create a user that can write, publish posts but not manage anything?

Is there anyone with experience hacking user capabilities and/or roles that knows how to go about this? Thank you!!