Can I grant read-only access to accounts but still let users update contacts?

Yes. See Configuration for Restrict All Access for Accounts and Contacts for New and Existing Environments on Update 22B (Doc ID 2827976.1) on My Oracle Support for details.