Unfortunately, this is all the control Github provides on their scopes. There is no read only for repos scope. The only scope it asks for is 'repo' and email as an identifier[0]

[0] - https://developer.github.com/v3/oauth/#scopes