I'm afraid that API functions GetOpenFileName and GetFileNameFromBrowse do not have direct ways to prevent deleting files, creating directories etc.

Both functions use OPENFILENAME structure. It looks like GetFile() is a wrapper for one of them.