The best way to grant full access to a specific cloud resource to a branch in Spain, while other branches have only read access, is to create a network security group with the required permissions.
This group can be configured to allow full access to users within the branch's IP range while restricting others to read-only access.