There doesn't appear to be anything apparently wrong with your commands; it would be better if you could post the actual commands that you're typing into your client.
But note that search_path has nothing to do with access privileges. All it does it control which schemas are checked to find objects, and the order in which to check them. So if you have happen to have two tables with the same name in different schemas (public.foo and xx.foo), the search path will determine which table it finds. The search path can always be overidden by manually specifying the schema or simply changed by the user himself.
To make a role "read-only" on a schema, then you need to do the following:
GRANT USAGE ON SCHEMA xx TO some_role;
REVOKE CREATE ON SCHEMA xx FROM some_role;