specific permissions for a group

I’m trying to find a way to assign very specific permissions to a global group in a mixed mode domain.
eg. allow this group read permission for event log, start and stops services.
any thoughts?