In CA Release Automation 6.5 and earlier you could set the user to be a "Release Designer" and then specify which Templates you wanted the user to be able to create releases from (available via the environment -> "Can execute only releases created from these templates"). At that point a user could try and submit a release for a deployment plan created by a template they didn't have permissions to but would get the error "User has no permissions."
However, in 6.6 the new User Management page still makes "Release Designer" privilege available but does not offer any way to specify which Templates the user can execute releases from. So they would need the permission "Execute Releases In All Environments" at the application level or to "Can Execute All Releases" at the environment releases - effectively giving the user access to deploy any/all templates.
CA Release Automation 18.104.22.16840
The feature of granting permissions templates was added for the “old” (pre 5.X) templates architecture. Later, we changed the templates feature, the “old” templates became the template category, and we added new deployment templates under the categories. We didn’t change the permissions accordingly, so the permissions (prior to 6.6) were actually for categories rather than deployment template.