Read-only access to git-shell via SSH

I've got a system account which has its login shell set to /usr/bin/git-shell and that works well for read-write access to git. What I am looking for is a way to add an additional SSH key with a forced command such that "clone" is the only option and it fires automatically if that key is used.
Addding other programs or services to that server are not an option this time. How can I provide read-only access like this with just git-shell in ~/.ssh/authorized_keys with command="..." ?

Again, the login shell is git-shell and I am looking for a way to use that with an SSH forced command.