Read only access to universe using IDT

Is it possible to give a user using IDT read only access to a universe. Where user would be able to retrieve universe, but not be able to change or publish universe. Have had to put user in the administrator group so that they could retrieve universe, but we do not want them to have full access rights.

Thanks,

Bob