I think I have worked out how to do this now:

     //Add a new tab
            TabController tabController = new TabController();
            TabInfo tabInfo = new TabInfo();
            tabInfo.PortalID = PortalId;
            tabInfo.TabName = tabName;
            tabInfo.Title = tabName;
            tabInfo.Description = tabName;
            tabInfo.IsDeleted = false;
            tabInfo.IsSuperTab = false;
            tabInfo.IsVisible = true;
            tabInfo.ParentId = TabId;
            tabInfo.TabID = tabController.AddTab(tabInfo);

            //Set the permissions for the new tab
            PermissionController objPermissionController = new PermissionController();
            ArrayList permissionsList = objPermissionController.GetPermissionsByTabID(tabInfo.TabID);
            UserInfo user = UserController.GetUserByName(PortalId, loginUsername, false);
            foreach (PermissionInfo permission in permissionsList)
            {
                TabPermissionInfo objTabPermission = new TabPermissionInfo();
                objTabPermission.PermissionID = permission.PermissionID;
                objTabPermission.TabID = tabInfo.TabID;
                objTabPermission.RoleID = Int32.Parse(Globals.glbRoleNothing);
                objTabPermission.RoleName = Null.NullString;
                objTabPermission.AllowAccess = true;
                objTabPermission.UserID = user.UserID;
                objTabPermission.DisplayName = user.DisplayName;
                TabPermissionController objTabPermissionController = new TabPermissionController();
                objTabPermissionController.AddTabPermission(objTabPermission);
            }

            //This is important - you need to make sure the cache is flush or the tab wont appear
            DotNetNuke.Common.Utilities.DataCache.ClearModuleCache(TabId);