For self registration without SSO
Try ConfigurableSelfRegHandler Interface
After the visitor fills out the sign-up page and submits it, the handler is invoked to create a community member with the information that the visitor supplies. If the registration process requires email or phone verification, the verification process finishes before the Auth.ConfigurableSelfRegHandler.createUser is invoked. If verification isn’t required, createUser is invoked when the visitor submits the page.
Return Value Type: Id
Returns an identifier for the created User object.
Auth.ConfigurableSelfRegHandler inserts a user and then returns the ID
of that user.
So you can create the user assign the permission set and return the user Id.
For SSO via SAML
Check out the SamlJitHandler Interface.
While provisioning the user, you can add the necessary permission sets.
createUser(samlSsoProviderId, communityId, portalId, federationId, attributes, assertion)
Returns a User object using the specified Federation ID. The User object corresponds to the user information and may be a new user that hasn’t t been inserted in the database or may represent an existing user record in the database.
The bolded text indicates that you can insert the user in your own method, add the perm set and then return the user you created.
For SSO Via Facebook etc.
As you pointed out, RegistrationHandler is very similar but it works for third party login apis:
Salesforce provides the ability to use an authentication provider, such as Facebook© or Janrain©, for single sign-on into Salesforce