When embedding a report with dynamic binding using the Embed Token - Generate Token endpoint, there doesn't appeat to be any way to restrict a user from calling the 'Save As' menu option.
It is possible to hide the menu option in the configuration options, however I wouldn't consider browser code secure, and a malicious user could change this configuration and create resources in Power BI service. I want to prevent them from doing this.
Unlike the similar endpoints for reports (Embed Token - Reports GenerateTokenInGroup), there is no field allowing you to specify 'allowSaveAs' on the token. I've tried using the Embed Token - Reports GenerateTokenInGroup endpoint and setting a dataset ID but this results in 403 forbidden errors.