As the database will be readonly you wont be able to make any changes to it specifically.
So your best bet is to create the login at botht he primary and secondary and grant access at the primary source, then set the DENY status for the login on the primary.
This will prevent connections at the primary server but allow connections at the secondary. This is how we have setup a log shipping reporting server and can't see why the same approach would not work in an availibility group setup.
MCITP SQL 2005, MCSA SQL 2012