Manage Roles and Capabilities on Multi-site

I believe you’d need to modify user roles on each site individually (if I’m understanding your question correctly).

There’s a great plugin I use frequently called WPFront User Role Editor that allows you to check/uncheck user capabilities like you mentioned. The free version should be fine for what you’re trying to do. I personally use the paid version just because I like to have the extra options when I need them, but 90% of the time the free one works fine.

You can view the plugin here