When to use a permission set instead of a new profile
Key Takeaway
When some users on a shared profile need extra permissions, create a permission set with that access and assign it only to them, instead of cloning or creating a profile. Their profile stays the same, so they keep its defaults.
A profile holds a user's default settings, and every user has exactly one. A permission set adds permissions on top of the profile without changing it, and a user can have several. Salesforce recommends granting access through permission sets and keeping profiles for the defaults that must live there. So when someone needs extra access, the usual answer is a permission set, not a new profile.
One profile, many permission sets
Every user is assigned only one profile. Depending on the Salesforce edition, a user can also have multiple permission sets. You assign a profile when you create a user. The profile defines that user's default settings. A permission set extends a user's functional access without changing their profile.
Permission sets are additive. If a permission is off in the user's profile but on in one of their permission sets, the user has the permission. For example, a user whose profile doesn't enable "Manage Password Policies" can still manage password policies when one of their permission sets enables it.