On SFDC's side, all you need is to clone the readonly profile. Just call it FlexeraReadOnly. An admin is required to setup the connected app and assign the profile to a user but the account itself does not need many rights.
Hey Frank,Do you think you can restate your question? I've done a number of Salesforce integrations for my company. We have almost 30. Perhaps I can help to answer some of your questions if you haven't completed the integration yet.