I am a unit admin, how do I grant/disable permission to a particular user in a group? On what basis groups are created?

Permissions cannot be granted to each user individually. If you do (do not) want to grant permission to any user, you must create a group with (without) that permission and add the user whom you wish to (not wish to) grant that permission.