There is a pre-created user group that only allows the members to read Active Directory and not make any changes. This is the Windows Admin Center Readers group. You just need to add users to this group.