Is there a way to add node grants to anonymous users?
You might get this to work by using the Group module. Below are some details about how to do so.

1. Configuration


Create a Group Type (pick whatever name you want).
For this case, there is no need for special (custom) Group Roles for the Group Type you created. Since you'll be able to configure what you want by using these Special Global Roles (hardcoded) that come with the Group module (they cannot be defined by the Drupal administrator, and they are always available for any Group Type):


"Outsider": a signed in user that did not join a group.
"Member": a signed in user that did join a group.
"Anonymous": a user that is not signed in.

Create a Group (pick whatever name you want) for the Group Type you created, and let's say you name it "Promoted nodes" (feel free to use another name if you prefer).
Grant the appropriate Group Permissions for the configured Group Type. To do so, you can also configure for each Content Type which Group Role has what kind of access (= none, view, create, edit, delete). Be aware: even though this looks similar to Drupal's permission configuration, these Group Permissions are not the same permissions (they are specific to the Group module). With the above setup in place, just grant "view" access to the Special Global Role named Anonymous (and pick whatever rights you want for the other roles).


2. Granting access

With the above Group module configuration in place, all you need to do is:


assign each promoted node to the Group "Promoted nodes".
remove the node from the group again if it is no longer promoted.


For sure this assign/remove can be done manually (whenever a node is edited), but it should be straight forward to somehow automate it using "promoted or not" as the trigger to do so (using the API that comes with the Group module).

More info

Refer to "How to create collections of content that can be accessed by users with various access levels?" for more  info about all this.