This may be 2 asks/requests but there are 2 things I would like to see modified for comment-only access.
- Comment only users should be able to add projects to portfolios.
- comment only users should not be able to post project updates.
This seems counter intuitive. It seems that the only things you can change in portfolios are the custom fields that appear when you click to view the project update, and the overall project time-line. But a comment-only user updating a project status, that is viewable on the portfolio seems like a greater risk.
Hi Will 
Thank you so much for sharing your thoughts with us.
You are correct, it’s currently not possible for comment-only users to add projects to Portfolios.
On the project level, members who can comment only or are assigned a task with comment only permissions, can only post project conversations and project status updates.
We appreciate your feedback and can totally see how these permissions can be improved, so I went ahead and passed on your valuable feedback to our Development Team to consider.
Hope this helps! If you have any further questions or concerns please don’t hesitate to reach back out.
Thanks again, @Will.S 
We have just discovered that even though we have the project to “Comment-Only” for all members and individuals (from “Project Members & Access” window) that any person who is assigned a task (that’s pretty much everyone) can do much more than comment only - they can Modify Due Date, Modify Assignee, Complete Tasks, Modify Custom Field Values and some other things that are not just commenting. (Project permissions | Product guide • Asana Product Guide)
If that is Asana’s “Comment only” functionality that is absolutely crazy and just plain wrong for a centralised project management organisation.
I hope we are missing something and this isn’t the case??? (fingers crossed really tightly)
I believe the “Comment only” feature is very new, maybe the need to restrict this access for project managed organisations was not thought of and perhaps you could add a “Project/Program Managed” option which would do just as “comment only” says (i.e. change nothing else but allow commenting) for all members. Perhaps you could allow the assignee to change the status to 'QC ready" and change colour so that the project manager/line manager can check before allowing only the person with “Edit” permission to actually change check it as complete.
Allowing view only of tasks is a fantastic way to communicate tasks to teams and let them view their to do list and organise themselves. When they have done a task they manually submit to a line managers to run a quality check on the item before it is actually accepted as having been done. Only once the line manager informs the Project Manager that the task is done to a satisfactory level is the task check off and goes off the assignee’s list. Allowing people to check their tasks as complete removes the quality assurance layers. So to does letting them change the length of tasks - especially when it might impact downstream tasks (in most cases) as well as letting them take over the management of team resources by changing the assignee. I am sorry but the current implementation design really ruins the original intended concept of “Comment only”.
Your help to resolve or correct this situation is appreciated. Right now our schedules that took months to design and implement are at the mercy of people following a written guideline to not totally screw them up by changing the structure without even notifications going to the project managers (the one with the actual “Edit” permission).
As it currently stands this feature sadly doesn’t inspire a lot of confidence for Asana as serious project management software. So much else is spot on so please please please address this ASAP 