I am a unit admin, how do I grant/disable permission to a particular user in a group? On what basis groups are created?

Permissions cannot be granted to each user individually. If you do (do not) want to grant permission to any user, you must create a group with (without) that permission and add the user whom you wish to (not wish to) grant that permission.

You can create a group with few permissions or all permissions. When you create a user, he must me assigned to at least one group. Users cannot exist without a group. You can make a group with only one user or multiple users. A user can belong to multiple groups and enjoy the permissions granted to that group.
To create User and grant permissions, login to eMAM Director>Admin Tools>Manage Users>>Manage User Groups>Permissions.