There are ways to lock down IIS but DotNetNuke needs to perform writes in the virual directory it resides in or it simply won't have the functionality you expect. You will not be able to edit configurations, create new portals, install modules, upload files or skins without write permissions. These folks are pulling your leg a little bit because even IIS needs to write to some folders regardless of the worker process securty context. See http://support.microsoft.com/?id=812614

http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/3648346f-e4f5-474b-86c7-5a86e85fa1ff.mspx?mfr=true

If I assume Windows 2003 and IIS6, the recommended account for the ASP worker process is Network Service.

As for write privledges they are set for the IIS Application Pool under which DotNetNuke runs. There are specific miminum requirements for DotNetNuke but that does not include purchased or custom modules and I guarantee it is not worth your time to pick individual files or folders, it just gets far too complex to maintain/transfer/duplicate.

You might try another approach.  You could ask "How do many ecommerce sites, governement services, banks and the New York Stock Exchange use DotNetNuke?"

Their IT department will either give in or not, but I promise the answer will save you the trouble in the long run.