I would like to create a permission set or role which overrides the Opportunity Org-Wide Defaults of Public Read Only, such that users in with the permission set or in the role would only be able to see records they own.
What is the best approach to achieve this?
you can't restrict OWD. OWD is the lowest sharing level.
In this case you have to set OWD to Private and do changes to your sharing model.
you can use the following algorithm to define proper OWD for object
The permissions architecture always grants new rights. It doesn't support taking away defaults or privileges established at a higher level. For example, a Permission Set could grant "View All" or "Modify All" permission, which extends a more restrictive Organization-Wide Default, but the reverse is not possible.
When the Organization-Wide Default is Public Read Only, you cannot inhibit queries, reports, and list views from showing all records available to the user. At most, you can supply prebuilt reports and list views that are filtered by ownership, and build your own customizations (Visualforce/Lightning) to always query by owner.
Even so, there are numerous areas in the UI where non-owned records would be exposed, such as lookup dialogues and search.
There is really no route to this objective besides changing the Org-Wide Default.
