There is no way to grant just access to Services->UPNP
If you add the privs for pkg.php, pkg_edit.php then all the various package menu items of packages that use package XML through these will appear on the menus. But you can't just allow UPNP. It is an odd case, because it is a "built-in" package always supplied in the base system.
Need to add a priv that will grant access for pkg_edit.php?xml=miniupnpd.xml