Curious- Are you allowing all users to create O365 groups or limiting self-service creation?

We've disabled groups, but just recently created a security group of indivdiuals allowed to create groups, primarly because we have a large interest in Planner and want to allow some people to use that app.  I see a long-term vision of self-service but the controls to manage groups need to mature quite a bit so we can align internally with some policies and (such as a docuemnted bi-annual review of membership) and our risks accordingly.