It is possible to read hierarchical custom setting via $Setup(= global variable); however, each profile/user needs to activate the security feature Customize Application.
Activating that security feature will compromise the system because a user will have access to Apex classes and etc. Moreover, users can modify the custom settings entries.
Is there any workaround to read a hierarchical-custom-setting data via $Setup without activating the security feature Customize Application?
If you are using $Setup.<custom_setting_name>.<custom_field> in a formula field, every User should have read access to the hierarchy custom setting based on their profile. Even if they do not have a matching profile, the User will be able to read the Org Level Defaults for the Custom Setting. In other words, the formula should be able to make use of the Custom Setting and "just work".
You can't inhibit access to any custom setting via profiles, and there's no field level security. (The exception is a Protected Custom Setting in a Managed Package....)
If you are trying to implement this in Apex, you will be better off using one of the Custom Settings methods such as <custom_setting_name>.getOrgDefaults(); to make use of them
