How can I separate assign user groups and permissions for users?
Non-admin users cannot change permissions for Admin users.

However, I agree with what you've said on users being able to assign groups and permissions. On practically every site I build, I need the client to be able to assign users to the groups that I created, but not be able to change a new user's permissions manually. This should definitely be separated in to two different options in the control panel.

UPDATE: In 2.6.2996 Craft added this functionality:


The “Assign user groups and permissions” permission has now been
split into “Assign user permissions” and “Assign user groups”, and
the latter now has nested permissions for each of the user groups.
Users with the “Assign user permissions” permission are no longer
allowed to grant new permissions to user accounts that they
themselves don’t already have.