Hi Mark,
You were looking in the right spot and you are correct, there is no role "read-only student." You need to create the role as mentioned in my previous post. When you are done, you should test the new role in a test course and see whether the grades are still there and what students can do with this new role (only view or also edit).
As far as I understand roles, changing the capability of a role of a user only affects what the user can do in the future and has no effect on past grades. Of course if you allow a user to edit past activities, the gradebook will change as well. But a change of the role will not change the gradebook entries for a user.
With kind regards,
Hartmut