Permissions don't matter much. Of course you need to be able to disable permissions for specific apps, but if you want to receive e.g. user messages but not promotional spam, there is nothing you can do.
iOS has a "Time Sensitive notifications" type that will popup immediately, even when user assign the app to summary view. But the type is assigned by sender alone. It is still possible to spam it.
Granted, an app sending spam notifications often doesn't want to make this distinction..