GPO for allow reset passwords but deny creating/deleting domain users

How I can create a Policy that deny an domain admin creating new logins but allow to reset password? I have a structure with Windows Server 2016 and it is pretty important to deny some domain admin users to Create or Delete domain users.