Seriously?
This restriction makes them not an administrator, it makes them something else entirely, possibly slave to workflow or something.
Whoever is giving you these requirements (guest can upload files, admin cannot add users, etc.) really needs to get a clue. An administrator account is meant for that - administration. When your liferay instance is falling down, when it is on it's knees, when you need an administrator to get it back on it's feet, you certainly don't want any nonsense like this preventing them from getting their job done.
