How to disable a permission for a moderator role which is granted to an authenticated user?
Your key challenge is to get around what seems to be a contradiction, which is that a user with role "moderator" is, by design of Drupal, also an authenticated user.

By using the Rules module, it is possible to implement something that looks like restricting access to URLs that start with node/add, and this for one or more selected role(s). So you could use this as a kind of workaround, as further detailed below.

To "add content to a site" (as in your question), a user needs to enter such URLs (starting with node/add) to actually start doing so (or click some link that matches with such URLs). By "redirecting" those URLs for users with a specific role you can implement what you're asking for.

Here is a rule (in Rules export format) which should be pretty close to implement such access restrictions like you're asking for:

{ "rules_limit_access_to_node_add_urls_" : {
    "LABEL" : "Limit access to URLs to add nodes",
    "PLUGIN" : "reaction rule",
    "OWNER" : "rules",
    "REQUIRES" : [ "rules" ],
    "ON" : { "init" : [] },
    "IF" : [
      { "user_has_role" : {
          "account" : [ "site:current-user" ],
          "roles" : { "value" : { "4" : "4" } }
        }
      },
      { "text_matches" : {
          "text" : [ "site:current-page:path" ],
          "match" : "\/node\/add",
          "operation" : "starts"
        }
      }
    ],
    "DO" : [
      { "redirect" : { "url" : "no_access" } },
      { "drupal_message" : {
          "message" : "You are not allowed to use such path...",
          "type" : "warning"
        }
      }
    ]
  }
}


The above rule performs a redirect for users who have a role with role id = "4". Just adapt that role id to fit your moderator role (if needed) and import (using the Rules UI) the above rule and you should be good to go.