How do I give my CCO read-only access?

Invite them as a Read Only user. Note that the compliance consoles themselves require the Firm Principal role — if your CCO needs them, contact support@omegafp.com.