I’m not being a smartypants, I just find it way easier when someone says “I want Foo to do Blah” – It helps people focus on what you need and not speculate. (Also there’s a lot more SuperAdmins can do than what you listed, hence why I asked.)
With the exception of ‘Provision sites’ this actually is something per-site admins can do already.
Under network settings, check the box for “Allow site administrators to add new users to their site via the “Users → Add New” page.” That should cover Users and Approve Users per site, and will automatically prevent them from editing passwords/themes etc.
If you need this to be done for network wide users, then it’s more complicated, because there’s no difference between being able to add users, and being able to control users. Since you’re adding them to a network at large, it’s something that impacts the network at large, just like plugins. So for that, you may have to explain more what you mean with adding users. Do they need to be added to multiple sites, etc etc.
Billing levels I can’t speak for, don’t know what plugin you’re talking about, but since that’s normally handled per-site, it would be something a site admin should handle for their site.
Provisioning sites… THAT would be the case for writing a one-off plugin that would check ‘Are you an admin on your own site? Yes? Okay, you can create a new site.’ You would want to filter the signup form, or make your own form that only admins can access.
