Is there a “read-only” user type or guest access mode for external collaborators?

Sure, thanks to the variability of permission controls, it is easy to configure a read-only role for your clients, partners, or other stakeholders. Naturally, the restricted projects and its data remain completely invisible unless you explicitly say otherwise.