There's a new built-in role, Billing Reader. This role enables you to delegate access to just billing information, with no access to services such as VMs and storage accounts. Users in this role can perform Azure billing management operations such as viewing subscription scoped cost reporting data and downloading invoices.
Also, the Invoice API is in public preview. You can use it to programmatically download a subscription’s billing invoices. For details, see the blog post.