Multi-sig N of M where 1 of the keys can see the balance but not spend (read-only key)?
The author of this paper seem to have put some thought into the problem you describe and has proposed a solution that seems relevant to your question:

A new HD wallet that tolerates key leakage
Master key generation. Instead of one master private key, our HD wallet uses
m master private keys ˆd1, . . . ,ˆdm for some reasonably-sized m to be determinedby the requirements of the wallet. (For example, in the combined treasurer-auditor use case of Section 2, m must exceed the number t of departments in the organization.) To keep the master private key size down, these master private keys could be generated pseudorandomly with no loss of security using, say, therudimentary deterministic wallet described in Section 1.*

https://eprint.iacr.org/2014/998.pdf