Data Protection User Role

Anyone know of user roles in the Sphere Web Client to grant:

• "User A" with Read-Only Access to vDPA

          -and-

• "User B" with vDPA Backup/Restore Admin rights Only

I've tried assigning Read Only across the board but that removes the entire Data Protection Tab for that user.