Permission issues with Custom Content Entity exposed to REST API
Actually, this was a false positive error.. I did some testing with my REST Client in Chrome (please see screenshot at the end of the paragraph) and permissions are correctly working.

The issue was related to my XHR request which was (for some reasons) keeping a valid CSRF token and because of this I appeared to be identified as admin. And of course as admin ID 1, I was granted full access on CRUD..

Sorry and thanks for your time guys!