The two options you disabled are for offering time for synchronization not for doing the synchronization itself.
This is a different issue altogether, I suppose you are running your Pi-hole in some container? The only other way you could have no permissions I can come up with right now is an outdated core version.
Please update to the latest development-v6 version. You will find a new option ntp.sync.active which you can easily set to false to prevent any syncing from happening.