Consumer can not edit any resources so you can put that condition on that action to restrict download action.
Your file should have configuration like this.
<alfresco-config>
<config evaluator="string-compare" condition="DocLibActions">
<actions>
<action id="document-download" type="link"
label="actions.document.download">
<param name="href">{downloadUrl}</param>
<permissions>
<permission allow="true">Write</permission>
</permissions>
</action>
</actions>
</config>
</alfresco-config>
Other way is you can create custom evaluator where you need to check that which role current user has.
