@nullbyte
Yes it is possible with Apache Sentry. Pls find below a very high level steps
pre-request: Make sure you have sentry
You can create a group & assign the required users to the group.
Create a role & GRANT <read only> ON SERVER <myserver> TO ROLE <rolename> WITH GRANT OPTION;
grant role to the group.