Scanning account for PAM

We are configuring a local account to be used for scanning purposes by Beyond Trust. A minimum of login rights to retrieve user data will be required. What permissions can I map to the account?