That is certainly a way that is used quite often. It has a bit of a disadvantage in that you are baking those rules into the code, so if you change your mind, you have to change the code. Whether or not that's a real disadvantage is up to you.

Whether or not there is a better way probably depends a whole lot on the level of flexibility you need. If you are talking about whole forms being allowed or not, that could be somewhat different from 'a few controls' on a form that should be present or not. It also depends on whether or not you would ever want to change your mind.

Permission groups and roles could be talking about database access, which would be a different thing. In the case of forms, I'm not so sure that the actual work behind the scenes is all that much different from what you are already doing. It is certainly easier if entire forms, or menu items, can be denied to a user. Finer control requires a bit more work.