Removing the ability to change user roles or grant roles

Can I prevent a custom role that has been given the “edit users” capability from changing a user’s role to a higher level? Or prevent them from granting additional roles to users? Because without that I can’t stop my user admin from creating new users and making them editors or whatever.