1.Create a group in project model with read only access. Maybe you want to duplicate the project /user group and in the access rights tab have the access as read access to the various models. The user would require access to more than just project, they would need to task, stages, contact etc. Believe you have already created it). 

2. Create your projects as 'private' so you can limit the internal users having access to each project. Only invited users will have access and the level of access will be that of the individual user's access rights as their group

Yes, you would have to first create them as internal user and then invite them to project by adding them as follower to the project.

I would second @Ray recommendation of having them as portal users. With setting up this new group as internal users, the risk is that they might already have access to other projects which aren't set as 'private'.

.

See https://www.odoo.com/forum/help-1/how-can-i-share-my-projects-with-portal-users-odoo-17-4-258703