Hi Sam,
The only thing I did was to create a system role and explicitly allow course:view. I left all other permissions alone. If any of the learning support team needed further permissions then I've asigned them a role on a per course basis.
Cheers. Sam.