Answer
At the point this was raised, Aurena Permission Sets didn't support this level of granularity — only full CRUD access could be granted per entity via a Permission Set, with no way to selectively allow Update while blocking Create/Delete, even though Enterprise Explorer's equivalent security model does support exactly that kind of selective CRUD restriction. This was considered a limitation of Aurena's permission-set model at the time rather than a configuration you were simply missing — check current release documentation for whether more granular CRUD control has since been added to Aurena permission sets.