I've recently found this plugin and have been digging into the code a bit. I find the code easy to read and understand which is great because it means I'm able to solve many of my own questions.
I was able to find and define
HMBKP_CAPABILITY which allowed me to give a role permission to see the menu (but not manage settings as it is by default)
However, is there a way to block them from the schedule buttons. I have found the actions under
admin/actions.php which looks to be loaded with
admin/page.php but can't find a way hide these links.
The idea is I want the client to be able to download the backups but NOT break things