Have you noticed the “view only” permission level in SharePoint? The difference between read access and view only, is that view only permissions doesn’t allow users to download documents.
However, there is a glitch in 2010 in that this view permission level doesn’t work when you assign it to a group. The users in that group will still be able to download documents. You need to allocated this permission level to users directly if you don’t want them to be able to download.
You need to use Information Rights Management (IRM) if you wish to restrict stuff on an any more granular level.