Your understanding is correct, however, creating namespaces through OPL is currently significantly less bothersome than doing it through the API, although this will be addressed soon™.
There are some obvious pros and cons to using either. OPL supports some really fine grained ways to check permissions, while the API will obviously allow you to make more dynamic changes on the fly, programmatically.
For some OPL examples - I'm sure you have already seen this - you can check out the docs:
https://www.ory.sh/docs/guides/permissions/overview