If a user has Create Document permission for classifications and Read access to a Study, then they can create documents for that Study. Vault does not support study-specific create document permissions as of today.

For a workaround, Vault has an Archive TMF feature that prevents users from uploading documents to archived studies unless they have a special Manage Archive permission.