I've found that the only way to prevent this, is to set the file's existing Everyone (seriously?) and System NTFS permissions from Full Control, to read only. This prevents the file from being modified, but so far doesn't prevent payroll access.

This is incredibly cumbersome, since we deal with multiple years and versions, but it seems to work. It will require manual version updates, but that is the point isn't it?