If the access is via SQL (INSERT, UPDATE), it is possible.
You can create a role with RW access to the database resource and grant INSERT privileges without the SELECT privilege.

If the access is via Global (SET), it is not so simple. Because you need to grant RW permission to the Database Resource and, consequently, the user will be able to read the data from the global resource.

For example, you create the logs_w role and grant it to the user 

%SYS>do ##class(Security.Roles).Create("logs_w", "", "%DB_LOGS:RW")
%SYS>do ##class(%SQL.Statement).%ExecDirect(,"GRANT logs_w TO appuser")

%SYS>set $NAMESPACE="LOGS"
LOGS>do ##class(%SQL.Statement).%ExecDirect(,"GRANT INSERT ON app.Log TO logs_w")

If the user tries to execute a SELECT they will receive an error

LOGS>do $SYSTEM.Security.Login("appuser")
LOGS>do $SYSTEM.SQL.Shell()
[SQL]LOGS>>SELECT * FROM app.Log

ERROR #5540: SQLCODE: -99 Message: User appuser is not privileged for the operation

If the user tries to execute an INSERT, it will succeed.

[SQL]LOGS>>INSERT INTO app.Log VALUES ('Test 1')
1.    INSERT INTO app.Log VALUES ('Test 1')

1 Row Affected
---------------------------------------------------------------------------

But this permission is not valid for globals, the user will be able to read

LOGS>zw ^app.LogD
^app.LogD=1
^app.LogD(1)=$lb("","Test 1")

In this case you can follow other strategies, such as Applications and Privilege Escalation. Here you isolate the database and the user does not have default access when logging in. Access is granted temporarily when executing a method/routine. A simple example:

In a database to which the user has default access, create a method that receives temporary privileges to write to the protected database

Class service.Log
{

ClassMethod write(msg As %String) As %Status
{
   do $SYSTEM.Security.AddRoles("grant_logs_w")
   new $NAMESPACE
   set $NAMESPACE="LOGS"
   do ##class(%SQL.Statement).%ExecDirect(,"INSERT INTO app.Log VALUES (?)", msg)
   return 1
}

}

Create a Privileged Routine Applications for this method

set p("Name") = "grant_logs_w"
set p("CookiePath") = "grant_logs_w/"
set p("Description") = "Applications and Privilege Escalation"
set p("Type") = 4
set p("Resource") = "%Development"
set p("AutheEnabled") = 64        
set p("Enabled") = 1
set p("MatchRoles") = ":logs_w"
set p("Routines") = "service.Log:APP:1"
do ##class(Security.Applications).Create("grant_logs_w", .p)

The user does not have access to the LOGS database, but can execute the write method with temporary privileges.

APP>w $ROLES
%Developer,%DB_APP
APP>do ##class(service.Log).write("Test 2")

You may find more information in this legacy documentation:

https://docs.intersystems.com/latest/csp/docbook/Doc.View.cls?KEY=GDOC_legacy

Maybe it can help,

In the SYS.Database Class you can find the IsSystemDB(Directory) method that returns whether it is a system database.
It works on Caché and IRIS.

Documentation IsSystemDB - IRIS

Documentation IsSystemDB - Caché

Examples:

%SYS>set databaseDir = ##class(Config.Databases).Open("IRISLIB").Directory

%SYS>write ##class(SYS.Database).IsSystemDB(databaseDir)
1

%SYS>set databaseDir = ##class(Config.Databases).Open("CACHELIB").Directory

%SYS>write ##class(SYS.Database).IsSystemDB(databaseDir)
1

You can create User Events using the Security.Events class, with the Create method.

Example:

This process is related to the Caché System Monitor. Monitors various resources, including the Journal.

"Caché System Monitor is a flexible, user-extensible utility used to monitor a Caché instance and generate notifications when the values of one or more of a wide range of metrics indicate a potential problem."

You can Stop them or customize the Sampling Interval for your environment.

See more in the documentation Caché System Monitor  and Caché Monitor

You can try to change using Config.SQL class.

Example:
 

%SYS>w $SYSTEM.SQL.CurrentSettings()
ODBC VARCHAR Max Length:                     4096 (Default)

%SYS>do ##class(Config.SQL).Get(.p)
%SYS>zw p("ODBCVarcharMaxlen")
p("ODBCVarcharMaxlen")=4096

%SYS>set p("ODBCVarcharMaxlen") = 5120
%SYS>do ##class(Config.SQL).Modify(.p)

%SYS>w $SYSTEM.SQL.CurrentSettings()
ODBC VARCHAR Max Length:                     5120

Another suggestion,

If you use an exclusive Resource in your database (example %DB_<database-name>), you can use it as a reference. It is included in the .DAT and you can check it even with the database not created, just the physical file.

Example:

w ##class(SYS.Database).%OpenId("/usr/irissys/mgr/test1/").ResourceName

The SYS.Database class also gets other information, but nothing relevant for identification.

--

Or (perhaps not recommended) you can extract the original path directly from the .DAT, for example:

$ strings /usr/irissys/mgr/test2/IRIS.DAT | head -3
Cache DB
/usr/irissys/mgr/test1/
%DB_TEST1

You can review the 'UnknownUser' user's permissions. In the documentation it says that 'Embedded SQL' does not check permissions:

InterSystems SQL enforces privilege checking for ODBC, JDBC, Dynamic SQL, and the SQL Shell interface on InterSystems IRIS data platform. Embedded SQL statements do not perform privilege checking;

Or use an authenticated user with the proper permissions;

About privileges and users: Users, Roles, and Privileges

About authentication: Authentication and Authorization

I'm using Zabbix to monitor all IRIS status and it works great. Zabbix has alert features (Triggers) that communicate with me via email or communication channels (like slack) when an incident occurs. I collect status information, errors, performance, etc. I use SNMP protocol indicators and other indicators through ODBC, some created by me and others obtained through monitor collections.

You can try this using EmergencyId mode. Stop IRIS and start with the parameter:

Linux

iris start IRIS EmergencyId=user,password

Windows

iris start IRIS /EmergencyId=user,password

User and password can be anything. This will be used for login.

Once logged in as this user by the terminal, you can use the ^SECURITY routine in the %SYS namespace to change the password of _SYSTEM.

Documentation (Temporary):

EmergencyId Mode

^SECURITY

In Caché I use this:

set path = ##class(Config.Databases).Open("USER").Directory

set database = ##class(SYS.Database).%OpenId($get(path))

do database.DisableJournaling()
set status = database.%Save()

do database.EnableJournaling()
set status = database.%Save()

Maybe the "Next" method is missing.

Ex:

SET rs = ##class(%SQL.Statement).%ExecDirect(, "SELECT * FROM LISDB.ExternalUsers WHERE UserId = 83")

do rs.%Next()

write rs.%Get("Prefix")

If that doesn't work, put the command sequence you're running.

You can try to use %IGNOREINDEX