How to limit access to manage/create contacts by type via user roles?
This may not be the answer you hope for, but the way we have approached this for other multi-level sites is to keep the 'lower level' users completely out of civicrm and give them everything they need via Views and Webforms.