About API authorization

Hello everyone. Another application needs to use our API. We need to define a user for this. But we want to restrict this user. We want them to only read the fields we specify from the table. We don't want them to perform operations like insert, delete, or update. What's the best way to do this? Thank you in advance for your support.