Your organization uses an Azure Artifacts feed named 'Shared-Libs' to distribute internal NuGet packages. A new team of developers needs to restore packages from this feed in their local builds and in a pipeline, but they must not be able to publish new package versions or delete existing ones. The feed currently grants the 'Project Collection Build Service' the Contributor role. What is the most appropriate way to grant the new team the access they require while following least-privilege principles?