Let's be clear though: the items you suggest and the permissions requested will definitely allow someone to see Records in the database by virtue of having access to smart lists and schedule tab on the smart campaign. Allowing list import will grant access to the database.
Creating leads via Form would minimize access to the database, but not totally remove it.
The reality is Marketo doesn't have fine grained permissions. But what you could do is:
- restrict what they can see/edit on Lead Database
- Create Workspace/Partition that is for Testing only and cannot see the main database (longer to setup)