Have you noticed the “view only” permission level in SharePoint? The difference between read access and view only, is that view only permissions doesn’t allow users to download documents.
However, there is a glitch in 2010 in that this view permission level doesn’t work when you assign it to a group. The users in that group will still be able to download documents. You need to allocated this permission level to usersdirectly if you don’t want them to be able to download.
They will then not be able to download. BUT, a second glitch is that they will still be able to download PDF’s.
You need to use Information Rights Management (IRM) if you wish to restrict stuff on an any more granular level.