Figured it out. Need Create, Read, Update for JSS Object User.
Minimal permissions would be whatever ones are required to do it in the GUI. In this case, probably only Update and maybe Read on JSS Object user would be required, but JSS User permissions seem to be a little bit of a dark art.
The only additionally required permission is that the MUT v3+ verifies credentials on a GET of the Activation Code, so giving the user permission to Read the Activation Code will allow it to pass the MUT authentication check and then you can minimize permissions on what you actually want to do.
I put a note in there recommending full admin due to a large number of people running into permission issues and getting frustrated with the tool.