"none" does not (normally) give you read-only access; if something is world-writable, none will be able to write it. but getting read-only is pretty easy; see exportfs(4) and the files which use it in /rc/bin/service. from emory, i'd say "exec /bin/exportfs -Rr /lib/music" would do what you want.
i've used nfsserver to provide access to a bunch of different types of unix hosts, but it has been a while. i just spent a few minutes right now trying with OS X and a remote plan9 server with no joy, but i'm not convinced i don't have a nat being disruptive. as far as the examples in nfsserver(8) go: "ivy" is a machine which responds to 9fs and exports a namespace containing /etc/passwd and /etc/group; it is most likely a unix system running u9fs or similar. /lib/ndb/nfs contains a 9fs command to mount ivy, so you can look at the live passwd and group files. if you'd rather not, or are unable to, get u9fs working on some authoritative unix system, you can copy or create a representative set locally (say, /lib/ndb/unix.passwd) and change the last two file names in the /lib/ndb/nfs example to point to those. "edith" and "yoshimi" are just 9p servers, most likely plan9 machines. passing them in the -a argument to nfsserver means that nfs clients attempting to mount the machines will have those two "shares" to pick from. i believe the example becomes inconsistent here; i think edith/yoshimi should match bootes/fornax. so if you had run the example as given here, you'd want to run "/etc/mount -o soft,intr eduardo:ivy /n/ivy" on your unix system. i forget whether the "share" ("ivy") needs to match the exact string given to -a ("tcp!ivy") or if just the hostname is okay.