Your setup is actually the recommended one if you use ReadonlyREST for Kibana.
You don’t need to install it in every node, only the ones to which Kibana connects to.
At CERN they have a similar setup. In fact, one of the top 3 winning points of ReadonlyREST for them was that you don’t need to add an extra plugin to a stable, production cluster.
Just spin a non-master, non-data node and point a Kibana instance to it. This lets you experiment safely and iterate really fast.