Unfortunately, the setup menu as a whole is all that yo can secure to a role as you have seen.
All the sub-tabs within setup will will available to everyone with the "setup" change enabled.
This would require a feature request be submitted for a change in PanOS to accomplish with your sales engineer.
I would recommend you give all the users read access to the tab then setup a system where they can submit the change request they have for the items located here via the help desk or some other existing mechanism.
I agree with with Steven. Currently it is not possible to choose the import/export config options in admin role. You can submit a feature request through your SE so that this can be implemented in future versions.
With the current features, the best you could do is to create two roles one with access to 'setup' and other without so that you can assign it to an admin if he needs setup access or not.
Let us know if it helps.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!