Odoo 19 Community — restrict a user to blog publishing only?

Hi 👋🏻 Good evening everyone.

Running Odoo 19 Community (self-hosted). I need one user to manage the company blog (write and publish posts) but nothing else on the website.

The two built-in Website access levels don't fit:

• Restricted Editor edits but can't publish.
• Editor and Designer publishes but unlocks the entire site.

I know publishing is tied to the website_published field, which seems to require the full Website publish permission. That's the part I'm stuck on.

Questions:

1. Best practice to build a custom group granting create/write + publish on blog.post only, without granting site-wide publish rights?
2. Any third-party module that already does this and is confirmed working on 19.0 CE?
3. What is the most scalable way to address this problem?

Willing to write a small custom module if that's the cleanest path — just want to make sure I handle the publish permission correctly. Appreciate any pointers.