Any commands in this guide are to be run on the CloudKey over SSH.
Do this through the web interface, create a local user with username & password (not email address). It doesn't matter what you set the password to, you'll never use it.
There's no option to set user permissions through the web interface for local users. We need to find out the ID of the View Only group...
psql -p 5433 -U unifi-protect unifi-protect -c "SELECT id from groups WHERE name='View Only';"