Just curious, my organization has some requirements to limit certain users from creating specific records etc within the standard objects of salesforce. Currently, because we are on professional edition, I don't have to ability to limit this due to the lack of profiles on Salesforce. I created a work around by assigning these users the Read Only standard profile, and then creating a permission set that allows these read only profile users to create certain records that we deem ok. Obviously, this isn't the best way of doing things, but it seems to work. Is there something I might be missing by doing this that could come back to haunt me in the future? If we upgrade to Enterprise, I will have to rework the profiles again anyway so that isn't a huge issue. Thanks in advance!
As a note, you can get custom profiles and page layouts for a nominal charge in Professional Edition. See this chart for a bit of info. Ask your account executive about pricing.
As for the main question, there really isn't any inherent problems with properly planned out permission sets. The effects of permission sets are cumulative, not restrictive, so you can build them out as you like to give appropriate permissions to users.
The only actual downside is remembering to assign the permission sets to users after they've been created, and having to manage those permission sets as users change offices/job positions/etc. It's basically the same problem as having custom profiles to begin with, but with a few extra clicks involved with not having custom profiles available.
Overall, I don't see a problem with this configuration, as it's a perfectly acceptable use case. Technically, it's almost a bit more superior because you can enact fine-grained controls over similar users that would otherwise require completely separate profiles.