Additive permission set grants versus profile baseline
Key Takeaway
Profiles, permission sets, and permission set groups can grant access but not deny it. To keep a permission from some users who share a profile, disable it in the shared profile and grant it through a permission set only to the users who need it.
A profile sets each user's default settings. Permission sets add permissions and access settings on top of the profile. Salesforce combines them additively, so a user has every permission that any of them grants. You can't fix too much access by adding something, so where you enable each permission decides who has it.
Profiles and permission sets
Every user has exactly one profile, which you assign when you create the user. The profile defines that user's default settings, such as assigned apps, record types, and page layouts.
Depending on the edition, a user can also have multiple permission sets. Permission sets extend functional access without changing the profile. You can assign a permission set to users regardless of which profile they have.
Every profile belongs to exactly one user license type. In a custom profile, you can edit all permissions and settings except the user license. In a standard profile, you can edit only a limited number of settings.
In Contact Manager and Group Edition, you can assign standard profiles but can't view or edit them. You also can't create custom profiles in those editions. Permission sets are available in both editions.