Allow certain users to create subsites + secuirty groups while prevent them for managing site column

I am working on a sharepoint online classic team site collection which have publishing features enabled @ https://ourtenant/sites/projects/ and under this site collection i have another team sub-site @ https://ourtenant/sites/projects/Management/ then under this sub-site, we have around 50 sub-sites, where each sub-site represents a project such as https://ourtenant/sites/projects/Management/ProjectA/ & https://ourtenant/sites/projects/Management/ProjectB/ , etc.

now i want to grant certain users the ability to create project sites from a cusotm site template, and also the ability to create security groups and assign them to the project site which will have unique permission. now when i granted a user full control permission on the root site, he was able to create the sub-sites and security groups. but at the same time the user got permissions to manage the root site's  site columns and content types and all other components. so my question is if i can tweak the "Full Control" permission level to only allow these actions:-

1. create new project sites from the site template.

2. create 2 security groups (which have to be done from the root site level).

3. assign the 2 security groups inside the new project site which will have unique permissions.

so can anyone advice on this ?