While I do not use ant, I did some work a year ago that required deploying permissions for objects in a managed package via package.xml file and it should be similar to handling permissions for managed apex classes. I did all my work using workbench.developerforce.com.
I found that if you specify the object names including namespace prefix, you can retrieve permissions for the objects using the standard format as found in metadata api docs on permission set object
<?xml version="1.0" encoding="UTF-8"?>
You cannot use wildcards for object names - you must specify the full api name for each object, including namespace prefix. I beleive wildcard would work for permission set name but presume you would want to specify which one to use.
When deploying these components to production, as long as you check the box "allow missing files", the object permissions will deploy.
I'm not sure how that option translates to ant, but hopefully it does. You can see it on workbench if you go to migration > deploy.
While my work was focused on deploying field permissions for managed objects, I believe the same approach would work for the PermissionSetApexClassAccess component, which controls apex class access.