How to limit adding content of a specific content type to paid memberships only?
Assuming that your "Add blog post" matches with an URL like node/add/blog, you can use the Rules module to stop any user who is trying to use that URL, if that user does not have access to the role "Paid membership" that you have in place. Here is the actual rule to do so (in Rules export format, just import it in your own site and enable it there to see it at work):

{ "rules_limit_access_to_node_add_blog" : {
    "LABEL" : "Limit access to node\/add\/blog",
    "PLUGIN" : "reaction rule",
    "ACTIVE" : false,
    "OWNER" : "rules",
    "REQUIRES" : [ "rules" ],
    "ON" : { "init" : [] },
    "IF" : [
      { "NOT user_has_role" : {
          "account" : [ "site:current-user" ],
          "roles" : { "value" : { "4" : "4" } }
        }
      },
      { "text_matches" : { "text" : [ "site:current-page:url" ], "match" : "node\/add\/blog" } }
    ],
    "DO" : [
      { "drupal_message" : {
          "message" : "Adding content for selected content types (such as for \u0022\u003Cstrong\u003E[site:current-page:path]\u003C\/strong\u003E\u0022) triggers some extra (Rules) logic, as you can see here. I.e. for anyone who does not have the role to do so.",
          "type" : "error"
        }
      }
    ]
  }
}


The assumption in this rule is that your role "Paid membership" has a role-id of "4" (if not just adapt the role after you imported the rule to make it fit, or change the value of "4" before importing the rule). And if your URL is different from node/add/blog, then adapt that also to make it fit for your case. Obviously, the actual error message being shown may need tuning also. And if the machine name of your content type is not "blog", but "whatever", just change all blog occurrences to "whatever" before importing this rule.

Happy Rules-ing!