Create capability that admin cannot use

By default sub site admins can not use User Role Editor. Thus, if you as network admin exclude such capability from site local administrator role and apply that change to all sites, you can receive desired effect.