Profile-only settings versus permission set capabilities
Key Takeaway
Set a user's defaults and login limits on their profile, and grant object, field and user permissions through permission sets and permission set groups.
Every Salesforce user has exactly one profile and can also have several permission sets. Profiles set a user's defaults and login limits, and some of these settings can only be set on a profile. Permission sets, often bundled into permission set groups, are the recommended way to grant object, field and user permissions, because you can reuse and stack them.
How permission sets add to a profile
A permission set adds access without changing the user's profile, so you can grant access for a specific job or task to users who have different profiles.
Permissions add up across a user's profile, permission sets and permission set groups.
For example, imagine that "Transfer Record" isn't enabled in a user's profile but is enabled in one of their permission sets. The user can transfer records.