This may well be a complete noob question, but when I go to the save as window (still using M4L in Ableton 8 – sorry, I am skint!) there is an option to save as a Ableton Max Patch, or a Ableton Live Max Device. I assumed that the Device would be an uneditable version for publishing, but I cannot seem to see any difference. I have also looked for any documentation or other posts to no avail.
I’m not at my DAW to confirm with 100% certainty, but I think saving a patch would allow you to reuse the patch as an abstraction inside Max/M4L and saving as a device would allow you to load the device into an audio/midi channel inside Live.
to disable the user’s ability to edit the device you must "freeze" it. Freezing it will compile any externals and abstractions into one file, but afaik the user can still choose to unfreeze the device and edit it from there