Could you be more specific on which exact site settings?
Unfettered read only access to all site settings seems a bit of a blunt instrument and would include some very sensitive ones including saas keys.
You could build a plugin with group read only access to specific named set of site settings?
That would be a relatively small plugin.