IAM Role Assignment for AKS and Best Practice

I have a developer that needs access to an AKS resource. I want to give them read only access to the resource in Azure Portal so they can see pods/namespaces/etc. I believe the role they need is Azure Kubernetes Service RBAC Reader. According to some resources the RBAC roles for AKS are roles that grant permissions inside the Kubernetes clusters versus the non RBAC roles that grant access to manage the cluster's lifecycle like scaling and upgrading.

After granting the Developer access to the role listed above, they are unable to navigate to the resource within the portal.

I would guess that the user would also need some sort of basic reader role to get access to the actual resource. Is this correct? Do I need to grant generic "reader" access to the actual resource, the AKS resource, AND also grant them access to the internal roles?

What's the accepted way of tackling permissioning for individual resources?