Its not clear from you question if the same users will need write access via some other mechanism. If they don't then just grant read access to a role for each table and grant that to the user.

Otherwise... Your needing the same user to be able to write (sometimes).

You could see if toad/access sets up their product ids via:
dbms_application_info.set_module

see: v$session.program / v$session.module

Then use FGAC to set up a context upon login that would limit their data access to read.

A simple but much less efficient approach would be to write triggers for each table on update/insert/delete that tested the sessions context ( set via a login trigger) and if it was a toad/access context then raise an exception