well you can define a new role named learner support assistants,while defining a new role give him all the read permissions that you want to and prohibit all the write/edit permissions.after that create the accounts of the support assistants and add them to that role.That will definitely solve your problem.be sure to prohibit him from recieving any mail notifications(prohibit the notification options).
Roles and permissions
Role to see everything but not do anything
This discussion has been locked so you can no longer reply to it.