Full credit to this answer on Stack Overflow: you need to set the create_posts value to do_not_allow (or false in WordPress versions below 4.5) and crucially set the map_meta_cap to true:
register_post_type( 'custom_post_type_name', array(
'capability_type' => 'post',
'capabilities' => array(
'create_posts' => 'do_not_allow', // Prior to WordPress 4.5, this was false
),
'map_meta_cap' => true, // With this set to true, users will still be able to edit & delete posts
));