With the Matrix Authorization Strategy Plugin enabled to manage permissions at the project level, as expected, a user needs the Job.Configure permission to be able to edit pipelines on Blue Ocean. But without the global Job.Create permission, users can't see the Edit icon on the Blue Ocean interface.

Users can still access the pipeline-editor by using the "http://jenkins:8080/blue/organizations/jenkins/pipeline-editor/project/master/" URL.

Therefore, to configure pipelines with Blue Oceans, users need 2 permissions :

Global : Jenkins.Create (to be able to see the Edit icon)

Project : Jenkins.Configure (to be able to access the URL)