Actually, by trial and error I nailed it down to a combination of edit_users and manage_network_users. If I add those two capabilities to a user that otherwise just have the read capability (like a subscriber) then the add term button appears and works.
