I think we need to add more details about the limitations of Zabbix ACL in the official documentation (https://www.zabbix.com/documentation/2.2/manual/config/users_and_usergroups/usergroup#host_access_from_several_user_groups):

• user with "Read only" permission to "Templates" host group can't see list of templates (Configuration --> Templates) and can't choose template in the "Action" tab. At the same time, he can add a template to a host (if he has "Read-write" permission to that host);
• user with "Read only" permission to a host, can't see that host in the "Configuration" tab, but can use triggers from that host in "IT service" view (Configuration --> IT services);
• guest user can see "empty" maps.