Restrict creation of administrator users

I have defined three custom roles and their capabilities, and one of them could create users. However, if only wish it to be able to create users with those custom roles – right now it can create any type of users. Any advice on what to do (I can hack PHP files if necessary)