How to limit a sub-site admin's capabilities in a WPMU network?

Joe suggested "User Role Editor WordPress plugin" in another post. It looks great! Just one little question since it can not change role capabilities for "Administrator"

My question is how to remove some default capabilities of a sub-site admin?

The story behind the question is, on WPMU network site, once people registers a new sub-site, by default, he is the admin for this new sub-site, and I want to disable some capabilities or even not only disable but also hide all disabled capability menu links. For instance, to disable: add new pages, edit theme files, install new themes, edit menu or widget, etc.

Thanks!