I have something like these (I’ve tried indices and actions like in your example for this rule as well 
)
- name: "::DENY_KIBANA_DELETE::"
ldap_auth:
name: "ldap"
groups_any_of: ["XXX"]
type: forbid
indices: [".kibana*"]
actions: ["indices:data/write/delete"]
verbosity: error
and then for RW ldap user
- name: "::XX LDAP::"
ldap_auth:
name: "ldap"
groups_any_of: ["XXX"]
indices: [".kibana-*",".reporting-*", ".ds-.kibana-reporting-.kibana-*", ".kibana-reporting-*", "xxx-*"]
verbosity: error
kibana:
access: rw
type: allow
*some time ago I also tried to achieve something similiar using User access to index management - #10 by ronald.vanboven but that restriction blocked users from updating existing Visualisations and Dashboards.