I want an option to remove the "Can Design" role when sharing dashboards (yaml? admin settings? does it already exist?). I dislike the role because: Users don't realise that they're editing a temp...
Republish will overwrite any changes they have made designing their dashboard. You can set them to "Can View" but that does limit their abilities within the dashboard. Our users who are designers have often used your third option of duplicating the shared/published version and making changes.
Another option would be to put users in a group and make that group Viewer only.