Device access tags can be used to further limit the access of read-only accounts.
If a read-only an account has no tags defined, it can see all devices.
...
Assigning tags to accounts
Tags can be applied to read-only any account, to limit the access of that read-only account only to devices with that tag.
...