To help reduce spam, it would be nice to add the ability to change the {nav Default Edit Policy} for Differential revisions as well as restricting who can create diffs (for revisions) by adding a {nav Can Create Diffs} policy.
A similar approach to {nav Can Create Diffusion Repositories} and {nav Default Diffusion Repository Edit Policy} can be used to implement the aforementioned policies for Differential.
For now, a global Herald rule blocking unauthorized users from editing revisions is the best way to restrict their ability to edit revisions. The same goes for creating diffs.