Is there a way to prevent someone from creating a new user account, but still allow them to provision a user to a group?

I'm hitting RETURN key too soon, i'm guessing you got here to System Security Roles tab... I believe if you provision them here they have full rights. i.e. Changing Passwords for Native Accounts, updating email addresses, Group creation and provisioning... and Creating new users.
Although - if they're reached their license max, OneStream will prevent them from creating new users.