Create a role that grants update access via REST api but prevent the same via online access

We have a use case where a user is NOT allowed to update Projects or Contracts via online screens, but should be allowed to update the same objects (Projects, Contracts) via REST APIs using their own id (Not Service accounts). Is it possible to create a custom role to achieve this requirement. If so what are some of the privileges that need to be leveraged to achieve this functionality. Are there different privileges say one for online navigation (VIEW) and say one for CRUD operations (Create, Update, Delete). If so may be I can grant just the