You can't use wildcards in statements like you want. The easiest way for you to do what you want is to just grant the user the db_datareader role and make sure they're not part of a group with the ...