Reference a global address defined in a host project from a service project

Yes, you need a role granting access to the project that "owns" the Global IP Address. An example role is roles/compute.publicIpAdmin or roles/compute.NetworkViewer.