Mike Boe we have been able to do a similar sort of thing (draft only at project level with publish rights limited to certain categories) via overlapping security groups. If you assign the user a Role with extremely limited permissions, you can then add them to two security groups: 1) where they have read-only permissions at the project scope and 2) where they have edit/publish permission with the scope restricted to specific categories.