Customer would like a single AD account be granted read_only in NetScaler GUI/CLI via LDAP authentication. We have a dedicated LDAP policy/server; can i use a search filter to just this one single account? I'm used to group LDAP membership but not a single account. Is there a better way to do this?

Always better to only work with groups anyway so best would be created a RO group with just the one person as a member.

Echoing Andy. Create a ReadOnly and just add the one person.