Forgot to address the second question: by design multisig wallets already are watch-only. Because they contain at most one of the required signing keys (if you use a hot key) or even zero (if your signing key lives offline). The rest are xpubs.