You are on point. There's no 'update' method for permissions in the REST API. I'd suggest looking at the following github repo, where the note below is coming from: GitHub - bryantbhowell/tableau_tools: Package containing Tableau REST API, XML modification, tabcmd and repository tools
While you can implement your own wrapper around the REST API, I typically find it easier to use a pre-built library like the one referenced on the link above.
Hope this helps!