I think the best you can do right now is to use auto-linking rules, and hide the field used for the link criteria (e.g. create a field to hold the Public Id of a related entity, and hide that field). But then you are stuck with having to manually set this field for every link you want to create, which is made even harder since it’s hidden.
Now that we have entity-level permissions (thank you), we can switch our focus to relentlessly pestering the team for field-level permissions 