Hello fls_admin,
All default user roles can download content from a workspace. If you would like to restrict download access, you will need to utilize the Custom Role feature outlined here: How to Create a Custom Organization Role in the Configuration Center
Custom Roles are created by your organization’s administrator. The process to create a custom role can be found here: How to Add a Custom Workspace Role in the Configuration Center
If you do not have Custom Roles enabled on your organization, please email support@bluescape.com