...
We currently use the roles Office_Can_Upload_New and Office_Can_Replace for determining whether a user is allowed to upload a new asset and replace an existing asset, respectively, from the OC. These roles are not assigned to the light users out of the box, but they are assigned to the other user groups. Note that a user must also have the MediaPortal_Uploader role to be able to upload anything.
It is possible to disable uploads from the OC completely from the ConfigManager with the configuration option "Disable Office Connector uploads".
...