MPD can restrict specific actions to clients identified via a password (and allows multiple passwords with different sets of allowed actions as well):
password <password@permissions>
This specifies a password for access to mpd. The format is "password@permissions" where permissions is a comma delimited list composed of
"read", "add", "control", and/or "admin". "read" allows for reading of the database, displaying the current playlist, and current status of
mpd. "add" allows for adding songs and loading playlists. "control" allows for all other player and playlist manipulations. "admin" allows
the db to be updated and for the client to kill mpd. An example value is "somePassword@read,add". Multiple password parameters may be spec‐
ified.
(from mpd.conf(5)), so adding
password "<your_guest_password>@read,add"
password "<your_admin_password>@read,add,control,admin"
to your config file would allow you to
- connect to MPD using the password and only be able to add songs, read the database and playlist
- connect to MPD using the password and do everything else MPD and its clients offer