Read only access for time card

We want a delivered read only security role with similar page and data (but view only) access as the Time and Labor Administrator.

Our HR and Payroll departments both want access to view employee timesheets. Payroll team only needs access to support employee questions or research potential employee issues, but should never edit/submit an employee timesheet.  

Please let us know how we can achieve this requirement.