I found the solution and was looking in the wrong Namespace. The Group namespace is what I should have been using. This works:
blcli_execute Group addPermission "5016" /My/emplate/SmartGroup" "SA_WIN_LL" "ComponentTemplateGroup.Read"
The model type for Component Template SmartGroups is:5016 and other model type are listed in the blcli reference.
All is good now!