Change the validation access of the Ontology web service endpoints. Now, for the Delete, Read and Update ontologies, if you have the proper rights on the ontology itself (and not just /wsf/ontologies/) then you will be able to read, delete and update it.

However, if you want to create a new ontology, you have no other choices than having "create" permissions on the /wsf/ontologies/ dataset.