If no permissions are provided in the API call, then no site access is be granted.
When giving customers access to a site, it is important to note that some permissions are dependent on other permissions being present. For example, you cannot give a customer access to a site's SEO if they do not have permission to edit the site first. See below for which permissions are dependent on others for each site type.
If you would like to update the permissions that a specific customer has to a site, you can call the same API to overwrite any existing permissions.