How to create custom employee role that only gives read-only access to payroll documents of record?

Summary:

We have a requirement, for a specific group of employees, to create a custom employee role that solely gives read-only access to payroll Documents of Record (the employee needs to be able to download the documents). No other access is required. Can anyone advise how to achieve this please?

Content (please ensure you mask any confidential information):

Version (include the version you are using, if applicable):

25D

Code Snippet (add any code snippets that support your topic, if applicable):