Incorrect. You already have built-in monitor user in Gaia. Alternatively, create a new and assign monitorOnly role to it.
This user (you will have to reset its password) is allowed to SSH, CLISH only. It can run "show..." commands. In this context, "show configuration" is what you are looking for.
It will not "export" config out, but will allow auditors to see output of config as part of the ssh session. They can log the session and use the data.
You do not want to give read-only users access to expert. If you are looking for a capability to send a file out, that is exactly the issue. Expert mode trumps all CLISH restrictions.