Best way to set a hard drive to read-only/prevent ransomware file corruption

I often install Acronis workstation for my small office customers PCs, storing the images on a dedicated separate internal or external drive.  Recently I was made aware that Acronis .tib files can get infected by some ransomware viruses.  I saw a suggestion that I use the Acronis 'post' command option to set the drive as read-only after the backup, and use the 'pre' command to take it out of read only mode before it does the next backup, with the thought being that the .tib image files could not get infected unless the ransomware virus happened to hit just as the backup was being performed.  Does this all sound legit so far?  Is there a better way to prevent the .tib files from getting infected--short of unplugging the external drive?

I started searching for the best way to set the read-only flag on and off, but all I'm coming up with is using diskpart.  Are there any other good options that are more "user friendly",  that I can run from command lines or a batch file?  For example, a way to specify the drive letter rather than the cryptic "Disk number" in diskpart?

If there are no good alternatives, then I need answers to these questions if I have to use diskpart:

1) If I have them set up with an external USB hard drive, sometimes I notice that the drive letter changes, for no obvious reason.  If this happens, would the diskpart device number change as well?

2) If the device numbers DO somehow change without me or the Acronis program knowing that has happened, is it possible that the C: drive could get set to read-only?  Obviously that would not be good.  If the C: drive COULD inadvertently get set to read only, how would I get out of that situation?  Is it possible that the customer could get locked out of his computer in that situation by restarting?