creating restrictive users in virtual center

What Virtual Center role is most restrictive, yet allows a user to open a VM’s console?