Use the general access permission for limited access to a collection in the Viewer and read-only access in the Library. This access permission allows image export of up to size 5 (up to 3072 pixels on long side) and the the highest viewing resolution in the Viewer.
Note: Authorities are the only feature that are not automatically assigned to an access permission. By default a collection creator will have permission to read, add, edit, delete authorities. For all other users you'll need to manually assign the permission to the access permission for the collection.
Although users are able to upload any images they like, they will not be able to save the text they enter into the "Title", "Description", and "Copyright" fields if the credential they are assigned does not have write access for "Independent media Items" in the Administrator section. The "Save media Details" button will not actually work until you add write access for the credential.
Example 1: "Anonymous User" credential.