give them a user account with view only permissions