Super Admin role edit

We are looking for a way to have super admins who can only do certain tasks, such as:
-add / remove sites
-login to any network site

But not:
-edit any network / global settings for WP MS

Thoughts on the best way to accomplish this?