I have a requirement where we need to create a Tridion group, let's call it "Production that can only administer users in Tridion. Their activities would be limited to:

1. adding new users into Tridion
2. assigning users to existing groups
3. enabling/disabling users

Can this be achieved without having to grant Administrator privileges, e.g. by creating a special group?

The reason for this requirement is that the Production Support department has some team members who are not so savvy with Tridion and have a record of doing stuff they're not supposed to in Production environments. So we don't want them to "accidentally" mess up existing configurations.