In my org 4 users have the same profile and have all CRUD permission. My requirement is: I don't want to give create access to only one user with the help of custom setting, but I am not aware about custom setting. How can I achieve that?
You could potentially use a Hierarchy Custom Setting
My_Custom_Setting__c with a Checkbox field in a Validation Rule along the lines of
ISNEW() && $Setup.My_Custom_Setting__c.Can_Create__c
to allow only specific users to create a record of a specific type. But at that point, what you're really doing is reinventing permission sets.
Instead, you should either split your profile into two profiles (one of which has Create permission and the other does not), or remove Create permission from the profile and give the three users who should have this permission a Permission Set that grants Create rights.
Salesforce permissions are always additive, and for that reason solutions that try to inhibit existing positive permissions are always hacky and not recommended.