Need shell access for tcpdump, but nothing else

I know that there are multiple levels of user account control in the F5 LTM, but I'm struggling to find one that fits my need.

I have a user who has to troubleshoot connections from outside systems through to the server behind the F5. Thanks to our SNAT policy, all of these connections appear in Wireshark to be originating from a single address, which is expected. I'd like to give this user access to the advanced shell so a tcpdump can be run, but I dont want to give them any access to the configuration- no modify, create, or delete. Basically, I need an auditor role with shell access so a pcap file can be created and downloaded.

How can I create this user?