What I do is a little complex, but works fairly well. I store my data in CephFS, mount that read-only (CephX permission also allow only read access) on a Linux

What I do is a little complex, but works fairly well. I store my data in CephFS, mount that read-only (CephX permission also allow only read access) on a Linux box with a ZFS array which uses borg to copy from the mount to the array. The backup box also runs crashplan to back up from the mount.