consumer replica without update referrals?

I'd like to set up a read-only consumer that never returns referrals to 
a writable master server.  Basically, any write requests that aren't 
replication updates would just be dropped.
It doesn't look like there is an analogous setting for this in the 
suffix-level "nsslapd-state" variable.  The closest thing is "referral 
on update" (default consumer behavior).
Then there is the "nsslapd-readonly" attribute, but I think this would 
also disable updates from the master replica.
One way would be to set a bogus suffix referral, so that client updates 
are referred to a non-existent server.  Does anyone have a more elegant 
solution?
Thank you!
-- George