I am working on a sharepoint enterprise server 2013 sites mainly of type Team Sites. some of them have the publishing infrastructure enabled and the other do not have these features enabled. and inside the sites i granted some users Contribute Permission to allow them to add/edit/delete list items. but seems the Contributor users will be granted UN-expected permission which i was expecting. For example if a contributor user go to the team site home page (which we have added many web parts and customization inside it) such as http://servername/sites/hr/home.aspx then they can edit this page, add extra web parts, remove others web parts, etc...

so can anyone advice what is the best appraoch to prevent Contributor users from modifying the site pages while allow them to add/edit/delete list items?

now i read about this and i found 2 simiar links:-

Deny "Edit Page" permissions to Contributors on a publishing site?

Prevent Users from Editing Pages while maintaining Inheritance

and both of these links suggest to beak the inheritance of the site pages library and only allow admin users to edit the pages library, while allow other users to Read. while this will technically work (although i did not test it). but i think it will have the following drawbacks , so i am not sure if there is another appraoch which will prevent these drawbacks from happening :-

1. Breaking the permission on lists' levels is always a bad appraoch from performance perspective, as it will create performance overhead.

2. breaking the permission on the Pages library, will not scale well. for example if i do this to the root site, and i create a new sub-site, then i need to do the same process of breaking the inheritance on the Pages Library at the sub-site level also ...

so can anyone advice on this please?

Thanks