I wonder why this question hasn't got a decent answer yet after more than 4 years.
It's surprisingly simple :-) Just create a new script (standalone, or under another spreadsheet), and replace all the SpreadsheetApp.getActiveSpreadsheet()
calls by SpreadsheetApp.openById("spreadsheet-id")
in which the spreadsheet-id is the last part of the document URL; https://docs.google.com/spreadsheets/d/{spreadsheet-id}https://docs.google.com/spreadsheets/d/{spreadsheet-id}
Using this easy trick, you access the shared spreadsheet by your own script that is not accessible to the others.