Limited rights for user API

Yes you can do it exclusively through the rest API. here is an example of icontrol role creation.

POST https://192.168.142.17/mgmt/shared/authz/roles/
{
"name": "my_icontrol_group",
  "userReferences": [
    {
      "link": "https://localhost/mgmt/shared/authz/users/my_rest_user"
    }
  ],
  "resources": [
    {
      "resourceMask": "/mgmt/tm/ltm/pool/~Common~pool_turnkey/members",
      "restMethod": "GET"
    },
    {
      "resourceMask": "/mgmt/tm/ltm/pool/~Common~pool_turnkey/members/*",
      "restMethod": "PUT"
    },
    {
      "resourceMask": "/mgmt/tm/ltm/pool/~Common~pool_turnkey/members/*",
      "restMethod": "PATCH"
    }
  ]
}

• Where my_icontrol_group is the name of the role.
• user references point to a group of users or here a single (or list of) user.
• resources define which uri in the API are available with which method.