Great News! Although I was told by a Sage consultant that adding ship to's on the fly was removed (which it was) and the only option was to allow AR modify customer... Thats incorrect! you can leave that on view only in the role and under security check off allow Maintenace of customer data during data entry under the AR security options section. Now the pop up comes up and asks is this a new ship to when a ship to code is entered that it doesn't recognize without giving staff full access to customer maintenance. Phew!! On to issue #2

Using the role maintenance rights described, can't the user still modify the customer information by clicking the "Customer" button? I tried to test this, and the option to "allow maintenance of customer data during data entry" seems to let me click the "customer" button and make changes on the customer master. 

I am locked out from making changes via AR - Main - Customer Maintenance. However, if I have the right to maintain customer data during data entry" then I can get into customer maintenance via that button.

Here's a cross-reference to an older Sage City post that touched on this ( 13 years ago ! ) - Entering ship to address in Sales Order entry

It's possible I missed something in the various role permissions. If not, then a workaround would be to use Custom Office to disable the "Customer" button for users who should not have edit rights to customer data.

I will take a look at disabling that button. Thanks. It would be nice if it had its own permission to add them on the fly. I think there is a real need for it.