We prove a stronger statement, generalizing the desired condition "$0 \notin S + S - S$" to "$0 \notin a_1S + a_2S + \dots + a_kS$", for fixed integers $a_1, \dots, a_k$ with nonzero sum $a_1 + \dots + a_k$. (In the original problem we have $(a_1, \dots, a_k) = (1, 1, -1)$ (so $k=3$).

Fix a positive integer $N$ (we will specify further later), and take a large prime $p \equiv 1 \pmod N$ (we don't need Dirichlet—there are infinitely many by a cyclotomic polynomial argument, along the lines of using $x^2 + 1$ for $N=4$).

Again, we will specify the size of $p$ later. Now let $\alpha$ be an $N$th root of unity modulo $p$ (i.e. $\alpha = g^{(p-1)/N}$ for a primitive root $g$, so $\alpha$ has order $N$). Then the key is the following lemma:

Lemma. If the sumset $a_1S + a_2S + \dots + a_kS$ contains $0 \pmod p$ for arbitrarily large primes $p \equiv 1 \pmod N$, then there exist indices $i_1, i_2, \dots, i_k$ between $0$ and $N-1$ such that the polynomial $f(x) = a_1x^{i_1} + \dots + a_kx^{i_k}$ is divisible by the $N$th cyclotomic polynomial $\Phi_N(x)$ (over $\mathbb{Q}$, and thus $\mathbb{Z}$).

(We will use the irreducibility of $\Phi_N$, but we only need special cases such as $N$ prime, where the proof is easy.)

Proof. The idea is to “transfer” from $N$th roots of unity modulo $p$ to “actual” $N$th roots of unity. First, the sumset’s containing $0$ is equivalent to the existence of $0 \le i_1, i_2, \dots, i_k \le N-1$ (since $\alpha^N \equiv 1 \pmod p$) such that $f(\alpha) \equiv 0 \pmod p$.

We present two (similar) ways to do this. One is to use the Mobius-inversion-type definition of cyclotomic polynomials to show that in $\mathbb{F}_p$, the roots of the polynomial $\Phi_N(x)$ are precisely the residues of order $N$; in particular, $p$ divides $\Phi_N(\alpha)$. Now by Bezout's identity, there exist integer polynomials $A(x), B(x)$ and a nonzero integer $C$ such that $C \gcd(\Phi_N(x), f(x)) = A(x)f(x) + B(x)\Phi_N(x)$, where the $\gcd$ (over $\mathbb{Q}$) is, without loss of generality, monic. Assume for the sake of contradiction that $\gcd(\Phi_N(x), f(x))$ is constant, so, without loss of generality, identically $1$. Then plugging in $\alpha$, we get $p$ divides $C$ for arbitrarily large primes $p \equiv 1 \pmod N$, which is absurd. Thus $f(x)$ and $\Phi_N(x)$ share a complex root, and by the irreducibility of $\Phi_N(x)$, $f(x)$ is divisible by $\Phi_N(x)$. ($*$)

Alternatively, by counting roots, it is easy to show that in $\mathbb{F}_p$, we have the polynomial identity $x^N-1 \equiv (x-\alpha)\dots(x-\alpha^N)$. If $z$ is a primitive $N$th root of unity, then in $\mathbb{C}$, we have $x^N-1 = (x-z)\dots(x-z^N)$, so the symmetric sums of $z, \dots, z^N$ are congruent modulo $p$ to those of $\alpha, \dots, \alpha^N$. It follows by the theorem of symmetric sums that the product of $f(\alpha)$ over all valid indices $0 \le i_1, \dots, i_k \le N-1$ (each choice determines some $f$) is an integer congruent modulo $p$ to the (integer) product of $f(z)$ over all valid indices $0 \le i_1, \dots, i_k \le N-1$. Thus arbitrarily large primes $p$ divide the integer $\prod_{[0,N-1]^k} f(z)$, which must therefore be $0$. Thus there exists a choice of indices such that $f(z)$ is identically $0$, and thus the minimal polynomial $\Phi_N(x)$ (again, we use irreducibility as in $(*$)) of $z$ divides $f(x)$. $\square$

With the lemma in hand, the rest is easy. Choose $N=q$ any prime. Then $\Phi_N(x) = \Phi_q(x) = (x^q-1)/(x-1)$ divides $f(x) = a_1x^{i_1} + \dots + a_kx^{i_k}$, a $k$-term polynomial that is either identically zero or otherwise a nonzero polynomial of degree at most $N-1=q-1$. However, if $f$ is not identically zero, and $q>k$, then since $(x^q-1)/(x-1) = x^{q-1} + \dots + 1$ has degree $q-1$ (which is at least the degree of $f$), the coefficients of $f$ must all be equal. Yet $i_1, \dots, i_k$ cannot cover all of $0, 1, \dots, q-1$, so one of the coefficients of $f$ must be $0$, and therefore all must be $0$.

It follows that $f$ is identically zero, so $f(1) = a_1 + \dots + a_k = 0$, contradiction.