Hello,
With the 3 bullet points mention it's fine.
There is two ways that you could block and put on the "Only read" mode, the Static and Dynamic block, where you can be specific with the particular pages that are going to be blocked and also the Capability container, this option will stablish all the pages at once in "only read".
Have precaution when you are moving the REG_LOCK_NFC and the REG_LOCK_I2C, if you set theme both to 1b, it will permanently lock write access to register default values (it could be fixed by the I2C).
There is no need to use Password Protection, is independent from "Read Only" , but they could be combined if you would like to.
The static lock bits can set the pages from 03h to 0Fh with a one-page granularity to read only. The dynamic lock bits lock the rest of the user memory. Look at more details on the segment 8.3.6 and 8.3.7 from here.
For the Capability container you should check the example on figure 11 from the same link attached, this example will put on the 3rth byte 0x0Fh according to NFC Forum.
Hope the answer finds you well, if they're more question, you could ask more.
Regards,
Itzel.