Is there a way to create an address book entry for a host that only allows the remote viewer the "view only" permission and not be able to switch to 'full' once connected?
I haven't dug too deep into this yet, so far I've created a new address book entry for the host and set the default to "view only" but once connected to the host I can switch to "full". It doesn't appear to be controlled at the viewer end of the config.
Looking at the host config I see where you can enable or disable features, but it seems to be a global setting, not per session or login.
Is there a way to have various permission levels for remote viewers?
Access permissions are set on the Host side, not the Viewer's. Yes, you right saying that there are global permissions for connection modes in Host settings:
However, you can also set user-specific permissions but in this case you must enable an authorization method that allows you to assign permissions to users. These are RU Security, Windows Security and Custom Server security. With Single password authorization though you won't be able to set permissions because there are no user accounts per se.
Here is an example on how to set permissions for a specific user in RU Security:
You can learn more about authorization methods here.