It’s better to do this on setup rather than wait for the spam bots, and without doubt there is different ways of doing this – but the following locked down media wiki in this instance just how I wanted it too.

$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['user']['edit'] = false;
$wgGroupPermissions['sysop']['edit'] = true;
$wgGroupPermissions['*']['createpage'] = false;
$wgGroupPermissions['user']['createpage'] = false;
$wgGroupPermissions['sysop']['createpage'] = true;

This does what it says on the tin, and leaves you free to carry on filling your own mini wikipedia up how you want. You can find full explanations/wikimedia security settings here.