I am using Thermos to run forge and bukkit at the same time. How do I allow and disallow certain commands from mods?

What would be the permission I would need to put into the file for a command that is not from a plugin?

All plugins that use permission nodes will list them somewhere in their documentation. You'd have to read the plugin's documentation to find out what they are. Once those nodes are assigned to a group, the group can use any commands associated with the permission node and the plugin.

If a plugin doesn't use permission nodes, I believe everyone on the server can use the commands for it.

With 'documentation' usually meaning, read their wiki for the plugin.

We don't support any mods that combine forge and bukkit since Cauldron was abandoned. Forge and Bukkit have very different ways of doing things, and were not designed with compatibility in mind, so any usage together will cause problems that can be complicated to troubleshoot and/or resolve.

I would guess, start with the Basic PEX Tutorial and create your permissions.yml file just like anyone else would.

Running 2 wrappers at the same time is a completely foreign concept to me, but if all they're doing is allowing plugins, and you've chosen PEX to be your permissions plugin, you'd run PEX the same as you'd run it on any other server. (Beginning with the tutorial linked above. Read the other stickied posts at the top of that forum for the best self-help around.)