It doesn't make any sense to have user who don't have permissions to publish item that can create a new item and publish it. And still, we have this in K2 for long time, and after many complaints so far there is no solution for this.
So, I'm going to ask one more time: Is there any way to resolve this? Core hack, template override or maybe and update?
- Set new article default state to Unpublished
or
- FIX problem with permissions so that NO means NO
The settings you are referring to for front-end editing only.
Backend access is handled through the K2 params.
If you want to extend these params you need to look at the JED or getk2.org/extend for an extension that offers this functionality.