Unfortunately it’s not a question of user permissions. It’s more a question of the post/product flow programming. WordPress built-in post flow includes states: draft, pending (not visible to public and wait for moderation), published. If user can not publish a product, he can move it into a pending state and wait for moderation. Such product is not visible to a public.
In order to use/realize another logic of product flow and/or states changing you need to use special plugin.