Profiles vs. permission sets

What is the recommended way to grant a handful of users extra permissions (like Export Reports) beyond what their job-function profile provides?