As Christop mentioned there is an option to create read-only accounts.
The "problem" is that you'd get in every menu which include information about the 3rd parties internal network infrastructure (i.e. IPs, RADIUS, DHCP, ...).
This could be the reason they don't allow access to the system.
Or if they run different customers on the same cloud controller they also don't give you read access as you'd also check out the statistic data from APs that are not in your location.
So in my opionion they mean they could not restrict the access to only some windows in the GUI AND also only to a certain group of APs so they don't allow access to the system.
-Ron