I'm currently using the GMB API to retrieve reviews for clients' businesses and display them in their accounts. However, there have been numerous complaints that the app requests excessive permissions. It not only asks for permission to read review data but also to manage and delete business accounts. As far as I know, there is only one scope that allows access to reviews: https://www.googleapis.com/auth/business.manage. This scope requests full control of the business account. The question is whether there is a way to request read-only permission from users to access reviews.
I searched for an alternative scope, but didn't find any.
You can create a separate Google account, have them invite the account to these locations with less privileges (https://support.google.com/business/answer/3415281?visit_id=638145650569347659-461299355&rd=1#roles&zippy=%2Cunderstand-profile-owner-and-manager-roles) and authorize access via that account.