Custom Rule to ADD a record?

If you have a table of users where the key field is the user, or even the users email address, then you can use that table as a user focus table. 

Since the field is the user ID, you can relate that table to any other table through a reference field with the formula of the current user.  

Then you can look up whether the current user is allowed to add records.  

Then you would remove the ad button from most roles, except may be admin and make your own Add Record  button.   Of course, you'll have to figure out where to put this button. The button could be on existing records, or on some kind of parent record, or some kind of master  record where there's a dashboard on the homepage to take you to the special admin record, which would have the various restricted add buttons on them.  

Interestingly enough, I recently had a kinda similar use case. I typically try to stick with the auto-incrementing primary keys instead of altering the key field (e.g. to a User) for reasons I won't explain here. Anyway, it sounds like you could potentially leverage your existing Employees table in combination with Formula Queries and (conditional) Formula URL buttons to create a "Person Locator Service" or "Person Authorization Service." For example,

// _DBID_EMPLOYEES
// FID 3:    Record ID# (Integer)
// FID 999:  Quickbase User (User)
// FID 9999: Quickbase User Has xyz Permission (Checkbox)

// Return the Current User's Record ID
var Text QueryResults = ToText(GetFieldValues(GetRecords("{999.TV.'" & UserToId(User()) & "'}", [_DBID_EMPLOYEES]), 3));
ToNumber($QueryResults)

Instead of returning the Current User's Record ID (3 in the above example), you'd could return a boolean of whether the Employee has access to perform the given operation (e.g. Add the record). Maybe something like:

var Bool HasPermission = ToText(GetFieldValues(GetRecords("{999.TV.'" & UserToId(User()) & "'}", [_DBID_EMPLOYEES]), 9999));

Then, in a Formula URL (button) you can conditionally show or hide the button based on the results of the Formula Query.

var Text UrlAddRecord =
    // Show form to create a new record
    URLRoot() & "db/" & [_DBID_THINGS] & "?a=API_GenAddRecordForm"

    // Set field value
    & "&_fid_xyz=" & URLEncode ([…])

    // Return to the context where this button was clicked
    & "&z=" & Rurl();

If (
    // Conditionally display this button
    $HasPermission = true, $UrlAddRecord,

    // Default to hidden button
    null
)

I'm not saying any of this is a good idea, but it is interesting and sort of allows us to extend basic User info similar to a User Profile in other web apps. I'd consider building a playground Quickbase app to test the ideas before integrating it into your production app.

The simpler version of all this would be to hardcode the allowable list of Users into a variable and then conditionally show the button if the current User is in the list.

Use care with Formula Queries too, especially because they likely cause n + 1 query issues that I don't recall reading about yet!

I'd also suggest really digging into why Quickbase's native Permission system doesn't accomplish what you are hoping to achieve.