postgres 9.6 GRANT requirements for stored procedure
You have three options.  You can grant update on the table to the role.  You can grant update on the table to the user.  Or you can do neither of those and create the function with the "SECURITY DEFINER" option.

In the last case, then the user will be able to update the table via the function, but will not be able to update the table outside of the function.