I'm not going to stake who is right on this, but the UK/Gibraltar claim/action is based on the following justification:
Gibraltar's government said in a statement Friday that it is extending the detention of the supertanker by 14 days after obtaining an order from the British territory's Supreme Court.
"The Supreme Court has issued today's order on the basis that there are reasonable grounds to consider that the detention of the Grace 1 is required for the purposes of compliance with the EU Regulation 36/2012 on sanctions on Syria," the statement said.
Note that insofar the EU has refused to comment on whether the regulation was properly applied or not in this case.
The European Union's executive declined on Thursday to comment on the tanker detained in Gibraltar, saying that it had no information on the case and that implementing the bloc's sanctions was a matter for the member states.
Also the tanker might not have been under Panamanian flag at the time of its detention:
While several online shipping trackers say the vessel was sailing under the flag of Panama, the Panama Maritime Authority (PMA) said in a statement that Grace 1's registry was canceled on May 29 after it was notified the ship may be participating or linked to financing terrorism.
"The PMA ... was notified of the international alert regarding the vessel GRACE 1, which indicated that this vessel might be participating or being linked to the Financing of Terrorism, or in support of the destabilizing activities of certain regions led by terrorist groups," the PMA said.
Also, regarding ownership of that tanker:
Lloyd’s List reported Grace 1 had “a complex ownership chain” and was controlled by Russian Titan Shipping, a subsidiary of TNC Gulf, a Dubai-based shipping company. Executives connected with both companies hold Iranian university and technical qualifications, or list their names in Farsi.
So the details are still sketchy. I could not find the full text of Gibraltar Supreme Court decision on-line, insofar. It might have more details.
There's a more recent Gibraltar government press release on this though, which says among other things:
The Grace 1 was detained last week in Gibraltar when it freely navigated into British Gibraltar Territorial Waters to a point two miles off the Eastside of Gibraltar, having previously exited the international waters of the Straits of Gibraltar, on a pre-arranged call for provisions and spare parts.
The Grace 1's position well inside BGTW when boarded can clearly be seen on the attached screenshot. The ship remains detained in that area.
The detention of the vessel relates to the suspected destination of the cargo, the Banyas refinery in Syria, which is owned by a company, the Banyas Oil Refinery Company. This company is the subject of European Union sanctions under EU Regulation 36/2012, which is directly applicable in Gibraltar.
The investigations of the Royal Gibraltar Police continue and the vessel remains detained under an Order of the Chief Justice of the Supreme Court of Gibraltar.

So at least this much is clear: the Gibraltar government claims to have detained the tanker inside its own (claimed) territorial waters (BGTW), rather than in what they recognize as international waters in the Straights.
And regarding innocent passage, I'm speculating here since Gibraltar has not said anything about the issue in relation to Grace 1, but some news from 2015 discuss it in relation to Spanish vessels:
A vessel can only be considered to be on innocent passage through British Gibraltar Territorial Waters if it's moving continuously and expeditiously, and is not engaged in any activities that are prejudicial to Gibraltar or the UK. That's the basis of expert legal advice received by the Government on the question of innocent passage as it relates to the United Nations Convention on the Law of the Sea.
In November last year, the Government announced it had commissioned a legal opinion on the definition of innocent passage given discussions that were underway at the time relating to the procedure for categorising the entry into BGTW of foreign state vessels. Following the latest spate of incursions by Spanish vessels this month that provoked a formal protest by the UK, GBC [Gibraltar Broadcasting Corporation] asked Number Six Convent Place whether it had received this advice.
In reply the Government confirmed that it had. The legal opinion further states that when it appears objectively from the foreign vessel's behaviour that its purpose in passing through BGTW is to assert its country's sovereignty claim over the waters, its passage would not be deemed to be innocent under international law. Number Six says it will continue to pursue this matter with the Foreign Office on the strength of the legal opinion it's received.
That news was from 2015, but incidents with Spanish vessels were also reported in February this year.
So clearly the Gibraltar and UK governments are generally aware of the issue of innocent passage through BGTW, and they have a stance on it at least as far as Spanish vessels are concerned. That they chose not to mention/discuss innocent passage in the Grace 1 case probably means they think it doesn't apply to ships violating EU embargoes, presumably because allowing ships passing through Gibraltar's (claimed) territorial waters to violate EU sanctions/embargo is considered "prejudicial to Gibraltar or the UK".