ok, I just played around with my test install and I disabled all of the modules save the calendar and the docs like you, I then created a test workspace and under the permissions for the workspace you control who has access to what.
So for my test user I set permission to 'none' for everything except documents and events. Those I set to 'read only'.
I then logged in as my test user and every time I tried to add an event but I was able to leave comments on existing events.
Also by default you should note that when a user goes to the calendar they only see their stuff and would have to change it to 'everyone'
edit: oh, and under the user permissions, be sure to take away their ability to modify workspaces or else they could just go and give themselves what ever permissions they want
Is that more like what you were thinking of?