Rancher v2.4.x reached end of life in terms of maintenance, and 2.5.x is only receiving minimum security updates, so we recommend upgrading to 2.6.6.
If you need a role that is more restricted than a project member, you can create a custom role with fewer permissions than that. The "user base" role gives the user login access only, so you can add "get," "list" and "watch" verbs for the resources they need.
After creating a custom role, you would need to go to the cluster that the user needs access to, and add them (in the new UI for exploring a cluster) under Cluster > Cluster Members.
After logging in, the user can download the kubeconfig from the top nav of the cluster explorer.