Currently that global option gives the user permissions on all contacts, no matter in which workspace they are. The per workspace contact permissions tells whether the user can assign or not a contact to a workspace, but there's a bug that allows the user to assign a contact to a workspace anyway. Even more, there's a bug that if you give permission to a user to manage contacts you then can't remove that permission. This couple of bugs will be corrected in version 0.9.1 out today, but there's still some work to do concerning contacts permissions for next versions.