Hello, and welcome to the forum.
After you send the read command byte, followed by the bytes corresponding to the first address to be read, it is necessary to then send a "dummy" byte value for each data byte to be returned by the EEPROM. From your description, It is possible that you may not be doing this. This is the means of generating the clock pulses for the return of each byte.
Also, I assume that you would set SS signal low prior to sending the command byte, and that it should remain low until the last byte is returned from the EEPROM. For EEPROM communications this signal should be allocated from GPIO, rather than the use of "automatic" SS operation available within some SPI modules.
Regards,
Mac