Restrict Support team to only access the process instance and not the Process model object itself

So according to my understanding going through documentation, for a user (Support user)  to have permission to a process model instance but only read only access to that process model object,

A user should be added to "Designer Role" but not in the "Process model creator" system groups so that the user will not have provision to design or modify a process model object but still can view the process instance in monitoring with adminstrator permission

Please correct me if I misunderstood anything here for the scenario