By generating addresses you create a private key for that address that can be used to send bitcoins.
So getting those two things together is pretty hard and poses a lot of questions on what exactly and for what purpose you are trying to do with this.
Technically what you are asking is probably to generate an address, import it in bitcoind and then keep the private keys somewhere else.
But where do you want to keep them and how are you going to get them there in an automated way is a question on it's own.
Just disabling the feature of sending bitcoins in bitcoind is not supported and can't really be done without some tinkering (not to say hacking).
TLDR; Generating addresses means your machine knows the private key. What do you want to do with the private key?
As you need to get rid of it in order to have a watch only address. Otherwise you will not be able to use bitcoind.
To be clear - I want to use two copies of wallet.dat, one is hosted on web-server which is used for generating new addresses,
second more secure for sending. Of course there will be private keys on first server, but the problem is more in JSON-RPC.
It'l be better if I can set rules for JSON-RPC - what methods I can use, and what not.
