Private messaging access is entirely configured in the Private Message System plugin under Parameters > Create. Your PMS access configuration looks correct. What issues are you having with it?

As for the email form there is no access permissions for that. It's either allowed or it's not. Only way to add some access checks to it is redirect away from the email form if the user doesn't have the appropriate usergroup using a redirect auction in CB Auto Actions on the onBeforeEmailUserForm trigger.

I am getting a "you do not have permission to message this user" error message.

That's primarily controlled by the following parameters.

User Messages To
User Messages From Access
User Messages To Access

Please provide a screenshot of the Parameters > Internal > Create tab of Private Message System plugin so I can get a full picture of your configuration.

Could it be something in the privacy setting or CBSubs plan?

CBSubs shouldn't have any impact here, but CB Privacy certainly can. CB Privacy will check the privacy rules applied to the "pm" field in addition to if the user attempting to PM them was blocked. Try unpublishing CB Privacy temporarily to see if it's what is blocking the PMs.

For reference, where can I enable/disable it?

The email form can be turned off in CB > Configuration > General using "Email Handling" parameter.

Will disabling it also hide the menu references (see image)

Yes.

I like the auto action option. I gather the redirect can be set to throw up a custom message I create similar to the error message or would I need to create some kind of message page?

The redirect can include a message that will output to Joomlas message queue.

I did as suggested and disabled the Privacy Plugin and both email and private messaging worked. So it looks like I need to see what parameters there has affected access. Can you direct me as to which ones would restrict access by user group?

CB Privacy protects privacy messaging with the Profile Privacy field and the PM field. So both of those privacy controls are checked. So for example if a user has no permission to view that persons profile they can't PM them. The email form is protected by checking the Profile Privacy field as well, but instead of the PM field it will check the Email field.