Permissions for an outstaff team

Hi! I’m trying to figure out how to set up permissions for an outstaff team of translators so that they can use Directus, change content, HAVE ACCESS TO EXTENSIONS, but at the same time they can’t have access to the app’s settings and can’t delete anything? In our understanding, this is a classic case. We want the outstaff team to be able to work with our data, but not to be able to break anything irreversibly. I tried to add READ access to all the schemes, it was VERY inconvenient and time-consuming (there are HUNDREDS OF THEM!!!). And in the end it seems that translators still need ADMIN access to the entire application just to use 1 extension. Is there a quick way to give third-party teams READ / CREATE / UPDATE access to everything + access to extensions, but restrict settings access?

We would also like some of our developers to have READ/CREATE/UPDATE access to everything, including creating models + access to extensions, but restrict settings access and limit access to deleting models.