Set your models to be read-only. In Windows Explorer, right-click on the model file. Choose Properties. On the General tab, check the "Read-Only" attribute. Alternately, under the Security tab, you can fine-tune your permissions.
Users can still make changes to the model, but they can't save the changes to the same model name. They have to save it under a new file name.
Consider a version number in the model file name, such as "Ledger_v2.1.mod".
However unlikely, users determined to screw things up could go into Explorer and turn off the "Read-Only" attribute on the model. To prevent this, put critical models into a designated folder, then set the security levels of the folder under the folder properties.