which virtual center role is most restrictive

What Virtual Center role is most restrictive, yet allows a user to open a VM’s console?