How to grant create and update permissions to a custom role?
You may grant your permissions on install time of your module with a simple config in config/install/user.role.publisher.yml (about this):

langcode: en
status: true
dependencies: {  }
id: publisher
label: Publisher
weight: 3
is_admin: null
permissions:
  - 'add contact entity'
  - 'edit contect entity'


Your code above is not a "grant", it's a runtime-check of users permissions.