At our DR site when a R/O mount for a tape comes up, we have to flip the write switch. Then when the tapes are taken back into the Data Center, we have to flip the switch again.
Many years ago when the IBM GIVE process was starting to be used, it provided a means to allow the write ring to no longer be changed to protect a tape from being written over on a R/O mount.
Add the following records to your VMTAPE CONFIG file:
RINGCHK OFF GIVE READONLY
The GIVE READONLY turns the I/O over to CP. This means that even if someone calls for a R/O tape mount and then tries to write to it, CP will stop the I/O. This implementation/configuration is especially useful for those with silo or virtual drives.