Permission sets are one way but are messy when it comes to maintaining them in the future. Other way you could achieve is to clone the current profile and then add or remove the various permission on the profile and label it appropriately so you know in the future and assign the profile to the two users.
Another option is to not change any profile and to use role or public groups and assign only read access to the record using sharing rules. Assign the newly created roles to the two users or assign them in the public group.
Looking at this video will give you a better understanding. Basically what you are after is to have the Org-Wide Sharing Defaults for the sObject to be private and you have to create two sharing rules. So for example you have role X and role Y, and everything created by role X you give read/write access to role X and with the other rule everything created by role X you give only read access to role Y. It will be the same scenario if you go with a public group but this is useful if you have a flat structure in your organisation rather than a hierarchical one.
Hope it makes sense if not I`m happy to explain more.