I need to provide Read-Only access to the NAS over the internet. Its pretty easy to create a group of users who only have RO access. But how do allow only them and not users with higher priviges to access the NAS over the internet?
setup a VPN (openvpn, wireguard. etc) and only allow the users who need access. either your router may allow VPN to be setup or add something like a raspberry pi with a VPN added to it.
Do not allow direct access from the internet to your NAS. you would be asking for a world of hurt.