On the group main site >Administration. Then Manage Users and Roles there is no role to allow a user to view all clients and not be able to add or archive clients. There is a work around to take away the Administration rights add give them access to every single client. When a client is added those individuals that need view rights only would need to have the new client added.