I want to disable my subsite admins from accessing certain

I want to disable my subsite admins from accessing certain admin areas, but not all of them. Specifically, I want to disable their ability to click on "Themes", "Plugins", and a few that specific to our config. What's the best way to do this?