Allow certain users to create subsites + secuirty groups while prevent them for managing site column

If you want to rely on out of the box features, you will not be able to achieve this becuase if a user can create sites, he/she will be able to create site columns, content types and manage security. By the way, take a look at permissions levels in SPO to see the possibilites you have there by creating custom perimission levels where you use individual permissions