Setting up an MSI user permission set in Salesforce

Documentation for setting up users to have access to Marketo Sales Insights Visualforce component in Salesforce is terrible.

I have created a custom Marketo permission set and added all MSI Visualforce pages and Apex classes to it; users are now able to see the component on the page (still wish it was an actual VF page so could put it elsewhere on an LEX page but that is another gripe).

Question: short of trial and error, is there any documentation or guidance on how to limit the ability of users to certain actions based on Apex & VF access? I really only want users to have view-only access to Marketo data and I'm unclear if this is what all VF & Apex access provides, or whether I need to figure out how lock it down/what to remove. Thanks