So what would be the proper way to allow external clients to view only dashboards and queries in Redash?

There are two choices:

  1. Add users to your Redash instance and apply group permissions to limit their access
  2. Share public dashboards using the public sharing links