Users are able to use the eB web controls to upload files to approved/change controlled documents. We need to know what determines a person's ability to add files to approved docs.
If users got the Admin Permission, they can add the files to the Approved Changed controlled document.
To restrict the Web users to add file to the Approved document, we need to change the settings under below location:eB Director> System Administration > System Default > Uncheck the box as shown below
Hope this will help you to resolve the security/permission issue.