There is no mechanism to always restrict configuration permission of the children (branch jobs). It currently requires an override of hudson.model.Job#getACL(). This is not possible to do in multi-branch-project-plugin due to direct use of the existing FreeStyleProject, MavenModuleSet, IvyModuleSet, and MatrixProject types. Extending these types to override things such as the ACL was an attempted and failed approach.

Achieving this would be possible with the API suggested in JENKINS-32596.

The hidden template should remain configurable by config.xml web API and CLI API. Ideally should not be configurable in UI only, but if not possible then it's fine, since the user isn't linked to the template from any other page.