Is there a way to grant permissions to only add/delete roles (in Administer -> User management -> Users), but not have access to change permissions for those roles (in Administer -> User management -> Permissions)?

"Administer permissions" option in Permissions provides access to change both Roles and Permissions.