The most efficient way to do this is to create a “Read-Only” role and assign that to the (new) TA user account.  When you create the role, add the access the client wants them to have, and set the Read/Write permissions to "R".
Here is a help screen from TA Help:
Assigning Privileges to a User