Accessgroup: Create agents but not administrators?

We are using accessgroups to restrict the use of Configuration Manager.

Now we need an accessgroup that are only allowed to create agents, and not administrators. Is that possible to achieve?

I have tried to set “No Access” on the accessgroup administrators for this new accessgroup but you can still create a person with more access rights than yourself…