what is the difference between db_datareader and db_denydatawriter?
I am trying to assign a SQL Server database role to a user who just
  needs to be able to see data across all tables.


You should only make him a member of db_datareader.

By default, any newly created user has no permissions at all (unless you grant something to public or the corresponding login has some permissions at the server level: for example, view any definition at the server level implies view definition at database level once the login is mapped to a database).